https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 09:32:49 +0000 https://vulnerability.circl.lu/vuln/cve-2026-23066 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>rxrpc: Fix recvmsg() unconditional requeue</p> <p>If rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues the call - whether or not the call is already queued. The call may be on the queue because MSG_PEEK was also passed and so the call was not dequeued or because the I/O thread requeued it.</p> <p>The unconditional requeue may then corrupt the recvmsg queue, leading to things like UAFs or refcount underruns.</p> <p>Fix this by only requeuing the call if it isn&#39;t already on the queue - and moving it to the front if it is already queued. If we don&#39;t queue it, we have to put the ref we obtained by dequeuing it.</p> <p>Also, MSG_PEEK doesn&#39;t dequeue the call so shouldn&#39;t call rxrpc_notify_socket() for the call if we didn&#39;t use up all the data on the queue, so fix that also.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>rxrpc: Fix recvmsg() unconditional requeue</p> <p>If rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues the call - whether or not the call is already queued. The call may be on the queue because MSG_PEEK was also passed and so the call was not dequeued or because the I/O thread requeued it.</p> <p>The unconditional requeue may then corrupt the recvmsg queue, leading to things like UAFs or refcount underruns.</p> <p>Fix this by only requeuing the call if it isn&#39;t already on the queue - and moving it to the front if it is already queued. If we don&#39;t queue it, we have to put the ref we obtained by dequeuing it.</p> <p>Also, MSG_PEEK doesn&#39;t dequeue the call so shouldn&#39;t call rxrpc_notify_socket() for the call if we didn&#39;t use up all the data on the queue, so fix that also.</p> https://vulnerability.circl.lu/vuln/cve-2026-23066