CVE-2026-23118

rxrpc: Fix data-race warning and potential load/store tearing

4.7 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix data-race warning and potential load/store tearing

Fix the following:

    BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet

which is reporting an issue with the reads and writes to ->last_tx_at in:

    conn->peer->last_tx_at = ktime_get_seconds();

and:

    keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;

The lockless accesses to these to values aren't actually a problem as the read only needs an approximate time of last transmission for the purposes of deciding whether or not the transmission of a keepalive packet is warranted yet.

Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit arch.

Fix both of these by switching to an unsigned int for ->last_tx_at and only storing the LSW of the time64_t. It can then be reconstructed at need provided no more than 68 years has elapsed since the last transmission.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.10%Up 0.1 points since Feb 15, 2026

What each source reports

NVD Score used4.7

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix data-race warning and potential load/store tearing

Fix the following:

    BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet

which is reporting an issue with the reads and writes to ->last_tx_at in:

    conn->peer->last_tx_at = ktime_get_seconds();

and:

    keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;

Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit arch.

Record: CVE-2026-23118
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-362
Updated: 2026-11-05

CVE ListNo score

rxrpc: Fix data-race warning and potential load/store tearing

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix data-race warning and potential load/store tearing

Fix the following:

    BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet

which is reporting an issue with the reads and writes to ->last_tx_at in:

    conn->peer->last_tx_at = ktime_get_seconds();

and:

    keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;

Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit arch.

Record: CVE-2026-23118
Updated: 2026-11-05

EUVDEUVD-2026-6028No score

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix data-race warning and potential load/store tearing

Fix the following:

    BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet

which is reporting an issue with the reads and writes to ->last_tx_at in:

    conn->peer->last_tx_at = ktime_get_seconds();

and:

    keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;

Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit arch.

Record: EUVD-2026-6028
Updated: 2026-11-05

GitHub AdvisoriesGHSA-p8gw-hvf3-xmc44.7

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix data-race warning...

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix data-race warning and potential load/store tearing

Fix the following:

    BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet

which is reporting an issue with the reads and writes to ->last_tx_at in:

    conn->peer->last_tx_at = ktime_get_seconds();

and:

    keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;

Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit arch.

Record: GHSA-p8gw-hvf3-xmc4
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-362
Updated: 2026-11-02

OSVBELL-CVE-2026-231184.7

Record: BELL-CVE-2026-23118
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-04

OSVDEBIAN-CVE-2026-231184.7

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix data-race warning and potential load/store tearing Fix the following: BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet which is reporting an issue with the reads and writes to ->last_tx_at in: conn->peer->last_tx_at = ktime_get_seconds(); and: keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME; The lockless accesses to these to values aren't actually a problem as the read only needs an approximate time of last transmission for the purposes of deciding whether or not the transmission of a keepalive packet is warranted yet. Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit arch. Fix both of these by switching to an unsigned int for ->last_tx_at and only storing the LSW of the time64_t. It can then be reconstructed at need provided no more than 68 years has elapsed since the last transmission.

Record: DEBIAN-CVE-2026-23118
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

Show 29 moreShow less

OSVROOT-OS-DEBIAN-11-CVE-2026-231184.7

CVE-2026-23118 in linux - Patched by Root

Root has patched CVE-2026-23118 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2026-23118
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2026-231184.7

CVE-2026-23118 in linux - Patched by Root

Root has patched CVE-2026-23118 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2026-23118
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2026-231184.7

CVE-2026-23118 in linux - Patched by Root

Root has patched CVE-2026-23118 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-23118
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2026-231184.7

CVE-2026-23118 in linux - Patched by Root

Root has patched CVE-2026-23118 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-23118
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-231182.0

Record: UBUNTU-CVE-2026-23118
CVSS 4.0: 2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVAZL-77691No score

CVE-2026-23118 affecting package kernel for versions less than 6.6.130.1-3

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix data-race warning and potential load/store tearing

Fix the following:

    BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet

which is reporting an issue with the reads and writes to ->last_tx_at in:

    conn->peer->last_tx_at = ktime_get_seconds();

and:

    keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;

Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit arch.

Record: AZL-77691
Updated: 2026-11-05

OSVCLSA-2026-1782382498No score

kernel: Fix of 23 CVEs

net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
net: add xmit recursion limit to tunnel xmit functions {CVE-2026-23276}
x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 {CVE-2026-23005}
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY {CVE-2025-37945}
xfs: delete attr leaf freemap entries when empty {CVE-2026-43158}
ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr {CVE-2025-68183}
crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list {CVE-2023-53627}
bonding: annotate data-races around slave->last_rx {CVE-2026-23212}
rxrpc: Fix data-race warning and potential load/store tearing {CVE-2026-23118}
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock {CVE-2026-23368}
tracing: Do not register unsupported perf events {CVE-2025-71125}
ACPICA: Avoid walking the Namespace if start_node is NULL {CVE-2025-71118}
icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
nfc: rawsock: cancel tx_work before socket teardown {CVE-2026-23372}
bridge: cfm: Fix race condition in peer_mep deletion {CVE-2026-23393}
batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622}
bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue {CVE-2024-36938}
virtiofs: use pages instead of pointer for kernel direct IO {CVE-2024-53219}
acct: perform last write from workqueue {CVE-2025-21846}
NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
atm: clip: Fix memory leak of struct clip_vcc. {CVE-2025-38546}
efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}

Record: CLSA-2026-1782382498
Updated: 2026-11-02

OSVCLSA-2026-1786761805No score

kernel: Fix of 46 CVEs

wifi: ath11k: update channel list in reg notifier instead reg worker {CVE-2025-23133}
wifi: cfg80211: call reg_notifier for self managed wiphy from driver hint {CVE-2025-23133}
KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception {CVE-2025-37957}
KVM: x86: forcibly leave nested mode on vCPU reset {CVE-2022-3344}
RDMA/umem: Fix truncation for block sizes >= 4G {CVE-2026-53133}
crypto: arm64/poly1305 - fix a read out-of-bound {CVE-2022-50231}
tls: handle data disappearing from under the TLS ULP {CVE-2025-38616}
Bluetooth: btmtk: validate WMT event SKB length before struct access {CVE-2026-46140}
Bluetooth: L2CAP: complete CVE-2026-23395 hardening (chan_lock + ident clear + memset ordering)
wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit {CVE-2026-31579}
net: add exit_batch_rtnl() method
rxrpc: Fix data-race warning and potential load/store tearing {CVE-2026-23118}
virt/coco/sev-guest: Double-buffer messages {CVE-2023-53769}
ASoC: SOF: avoid a NULL dereference with unsupported widgets {CVE-2023-54233}
bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810}
scsi: qla2xxx: Free sp in error path to fix system crash {CVE-2025-71232}
sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting {CVE-2026-23371}
net: rfkill: prevent unlimited numbers of rfkill events from being created {CVE-2026-31670}
intel_th: fix device leak on output open() {CVE-2026-23091}
batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
rxrpc: Fix call removal to use RCU safe deletion {CVE-2026-31642}
i2c: s3c24xx: check the size of the SMBUS message before using it {CVE-2026-31627}
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop {CVE-2026-31498}
mtd: rawnand: serialize lock/unlock against other NAND operations {CVE-2026-23434}
x86/efi: defer freeing of boot services memory {CVE-2026-23352}
KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec {CVE-2026-23112}
usb: typec: ucsi: Handle incorrect num_connectors capability {CVE-2025-71108}
KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer {CVE-2025-71104}
drm/ttm: Avoid NULL pointer deref for evicted BOs {CVE-2025-71083}
amba: bus: fix refcount leak {CVE-2023-54230}
exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree {CVE-2023-54194}
octeontx2-af: Add validation for lmac type {CVE-2023-54129}
rcu: dump vmalloc memory info safely {CVE-2023-54113}
wifi: rtw88: use work to update rate to avoid RCU warning {CVE-2023-54071}
bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps {CVE-2023-54033}
ASoC: soc-compress: Reposition and add pcm_mutex {CVE-2023-53866}
netlink: do not hard code device address lenth in fdb dumps {CVE-2023-53863}
md/raid5-cache: fix a deadlock in r5l_exit_log() {CVE-2023-53848}
tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak {CVE-2022-50824}
net: stmmac: fix possible memory leak in stmmac_dvr_probe() {CVE-2022-50663}
bpf: Fix reference state management for synchronous callbacks {CVE-2022-50650}
blk-mq: fix tags leak when shrink nr_hw_queues {CVE-2023-54227}
usbnet: Run unregister_netdev() before unbind() again {CVE-2022-49501}
scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ {CVE-2026-23395}
Bluetooth: L2CAP: Fix responding with wrong PDU type
netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}

Record: CLSA-2026-1786761805
Updated: 2026-11-02

OSVNo score

rxrpc: Fix data-race warning and potential load/store tearing

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix data-race warning and potential load/store tearing

Fix the following:

    BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet

which is reporting an issue with the reads and writes to ->last_tx_at in:

    conn->peer->last_tx_at = ktime_get_seconds();

and:

    keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;

Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit arch.

Record: CVE-2026-23118
Updated: 2026-11-07

OSVUSN-8567-1No score

linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)