CVE-2026-74429

The rxrpc protocol handler in the Linux kernel contains a state machine flaw that permits a server to send a reply before the client has transmitted any request data. The vulnerability manifests as a null pointer dereference in rxrpc_rotate_tx_window() when processing an early reply, but the underlying defect is a protocol sequencing violation—rxrpc's state tracking permits server responses to arrive before the client has begun sending. The patch addresses this by adding an exposure check to verify whether a call has transmitted its first packet before accessing the transmission queue, and changes a do...while loop to while to prevent unconditional queue access. This fix masks rather than repairs the underlying state machine. The original do...while pattern was a structural commitment to the assumption that the transmission queue would never be empty at that point—an assumption never formally specified and likely propagated to adjacent functions. This is not an isolated flaw. AF_RXRPC has accumulated a pattern of reception-before-state fixes that suggest the protocol's state machine was never formally specified, only reverse-engineered from expected traffic patterns. Each patch adds guards without correcting the architectural defect, meaning additional state violations likely remain latent elsewhere in the codebase. The practical attack surface is narrow. Exploitation requires either valid AFS credentials or a position enabling mid-call packet injection. However, this complexity makes the flaw more dangerous—it represents low-priority technical debt that accumulates because it's difficult to trigger, yet becomes valuable post-exploitation as a pivot or escalation path. The real risk extends beyond the immediate crash: inconsistent call termination may leave corrupted kernel bookkeeping that manifests as intermittent failures in AFS or other rxrpc consumers rather than visible crashes. Prioritize patching on systems running AFS or with rxrpc enabled, but treat this as a canary revealing deeper protocol design issues that warrant sustained attention in future kernel releases.

Reviewed through automated stages and approved by a human before publication.