[SRU][J][PATCH 0/1] CVE-2026-74436

[Manvi Kardam]

[ Impact ]

CVE-2026-74436 is a use-after-free issue in RXRPC service socket
preallocation. rxrpc_kernel_charge_accept() may access rx->backlog
concurrently with socket teardown, while rxrpc_discard_prealloc()
clears and frees the backlog.

[ Fix ]

Serialize kernel accept preallocation with socket teardown by taking
the socket lock before checking the listening state and accessing the
service backlog.

The upstream fix required a small backport adjustment for Jammy to
retain the existing rxrpc_user_attach_call_t user_attach_call argument.

[ Test Case ]

Built the Jammy kernel successfully with CBD for all targeted
architectures.

Installed the generated arm64 kernel packages in a Multipass test
instance and successfully booted kernel 5.15.0-199-generic.

[ Regression Potential ]

The change adds socket locking around RXRPC service preallocation and
checks that the socket is still listening and has a valid backlog
before proceeding. A regression could affect RXRPC service connection
acceptance or introduce locking-related issues in this path.

Li Daming (1):
  rxrpc: serialize kernel accept preallocation with socket teardown

 net/rxrpc/call_accept.c | 28 +++++++++++++++++++++-------
 1 file changed, 21 insertions(+), 7 deletions(-)

-- 
2.43.0