CVE-2026-23118 (GCVE-0-2026-23118)

Vulnerability from cvelistv5 – Published: 2026-02-14 15:09 – Updated: 2026-02-14 15:09
VLAI?
Title
rxrpc: Fix data-race warning and potential load/store tearing
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix data-race warning and potential load/store tearing Fix the following: BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet which is reporting an issue with the reads and writes to ->last_tx_at in: conn->peer->last_tx_at = ktime_get_seconds(); and: keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME; The lockless accesses to these to values aren't actually a problem as the read only needs an approximate time of last transmission for the purposes of deciding whether or not the transmission of a keepalive packet is warranted yet. Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit arch. Fix both of these by switching to an unsigned int for ->last_tx_at and only storing the LSW of the time64_t. It can then be reconstructed at need provided no more than 68 years has elapsed since the last transmission.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ace45bec6d77bc061c3c3d8ad99e298ea9800c2b , < c08cf314191cd0f8699089715efb9eff030f0086 (git)
Affected: ace45bec6d77bc061c3c3d8ad99e298ea9800c2b , < f8cf1368e0a5491b27189a695c36f64e48f3d19d (git)
Affected: ace45bec6d77bc061c3c3d8ad99e298ea9800c2b , < 5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b (git)
Create a notification for this product.
    Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 6.12.69 , ≤ 6.12.* (semver)
Unaffected: 6.18.8 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/conn_event.c",
            "net/rxrpc/output.c",
            "net/rxrpc/peer_event.c",
            "net/rxrpc/proc.c",
            "net/rxrpc/rxgk.c",
            "net/rxrpc/rxkad.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c08cf314191cd0f8699089715efb9eff030f0086",
              "status": "affected",
              "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b",
              "versionType": "git"
            },
            {
              "lessThan": "f8cf1368e0a5491b27189a695c36f64e48f3d19d",
              "status": "affected",
              "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b",
              "versionType": "git"
            },
            {
              "lessThan": "5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b",
              "status": "affected",
              "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/conn_event.c",
            "net/rxrpc/output.c",
            "net/rxrpc/peer_event.c",
            "net/rxrpc/proc.c",
            "net/rxrpc/rxgk.c",
            "net/rxrpc/rxkad.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.69",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.69",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.8",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix data-race warning and potential load/store tearing\n\nFix the following:\n\n        BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet\n\nwhich is reporting an issue with the reads and writes to -\u003elast_tx_at in:\n\n        conn-\u003epeer-\u003elast_tx_at = ktime_get_seconds();\n\nand:\n\n        keepalive_at = peer-\u003elast_tx_at + RXRPC_KEEPALIVE_TIME;\n\nThe lockless accesses to these to values aren\u0027t actually a problem as the\nread only needs an approximate time of last transmission for the purposes\nof deciding whether or not the transmission of a keepalive packet is\nwarranted yet.\n\nAlso, as -\u003elast_tx_at is a 64-bit value, tearing can occur on a 32-bit\narch.\n\nFix both of these by switching to an unsigned int for -\u003elast_tx_at and only\nstoring the LSW of the time64_t.  It can then be reconstructed at need\nprovided no more than 68 years has elapsed since the last transmission."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-14T15:09:49.845Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c08cf314191cd0f8699089715efb9eff030f0086"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8cf1368e0a5491b27189a695c36f64e48f3d19d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b"
        }
      ],
      "title": "rxrpc: Fix data-race warning and potential load/store tearing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23118",
    "datePublished": "2026-02-14T15:09:49.845Z",
    "dateReserved": "2026-01-13T15:37:45.969Z",
    "dateUpdated": "2026-02-14T15:09:49.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23118\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-14T15:16:06.933\",\"lastModified\":\"2026-02-18T17:52:44.520\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: Fix data-race warning and potential load/store tearing\\n\\nFix the following:\\n\\n        BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet\\n\\nwhich is reporting an issue with the reads and writes to -\u003elast_tx_at in:\\n\\n        conn-\u003epeer-\u003elast_tx_at = ktime_get_seconds();\\n\\nand:\\n\\n        keepalive_at = peer-\u003elast_tx_at + RXRPC_KEEPALIVE_TIME;\\n\\nThe lockless accesses to these to values aren\u0027t actually a problem as the\\nread only needs an approximate time of last transmission for the purposes\\nof deciding whether or not the transmission of a keepalive packet is\\nwarranted yet.\\n\\nAlso, as -\u003elast_tx_at is a 64-bit value, tearing can occur on a 32-bit\\narch.\\n\\nFix both of these by switching to an unsigned int for -\u003elast_tx_at and only\\nstoring the LSW of the time64_t.  It can then be reconstructed at need\\nprovided no more than 68 years has elapsed since the last transmission.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nrxrpc: Corregir la advertencia de condici\u00f3n de carrera de datos y el potencial desgarro de carga/almacenamiento\\n\\nCorregir lo siguiente:\\n\\n        BUG: KCSAN: condici\u00f3n de carrera de datos en rxrpc_peer_keepalive_worker / rxrpc_send_data_packet\\n\\nque est\u00e1 informando un problema con las lecturas y escrituras a -\u0026gt;last_tx_at en:\\n\\n        conn-\u0026gt;peer-\u0026gt;last_tx_at = ktime_get_seconds();\\n\\ny:\\n\\n        keepalive_at = peer-\u0026gt;last_tx_at + RXRPC_KEEPALIVE_TIME;\\n\\nLos accesos sin bloqueo a estos dos valores no son realmente un problema, ya que la lectura solo necesita un tiempo aproximado de la \u00faltima transmisi\u00f3n con el prop\u00f3sito de decidir si la transmisi\u00f3n de un paquete keepalive est\u00e1 justificada o no.\\n\\nAdem\u00e1s, como -\u0026gt;last_tx_at es un valor de 64 bits, puede ocurrir desgarro en una arquitectura de 32 bits.\\n\\nCorregir ambos cambiando a un unsigned int para -\u0026gt;last_tx_at y almacenando solo el LSW del time64_t. Luego puede ser reconstruido cuando sea necesario, siempre que no hayan transcurrido m\u00e1s de 68 a\u00f1os desde la \u00faltima transmisi\u00f3n.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c08cf314191cd0f8699089715efb9eff030f0086\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f8cf1368e0a5491b27189a695c36f64e48f3d19d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.