CVE-2026-23066: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23066 is a use-after-free (UAF) and refcount underrun vulnerability in the Linux kernel's rxrpc (RxRPC) subsystem, caused by an unconditional requeue bug in the rxrpc_recvmsg() function. It affects Linux kernel versions 4.11 through 6.18.7, as well as release candidates 6.19-rc1 through 6.19-rc6. The vulnerability was published on February 4, 2026, and patches were released in kernel 6.18.8 and 6.19-rc7. It carries a CVSS v3.1 base score of 5.5 (Medium), exploitable locally by a low-privileged user with no user interaction required (Feedly).

The root cause is improper queue management (loosely classified under CWE-674) in rxrpc_recvmsg(): when MSG_DONTWAIT is specified and the call at the front of the recvmsg queue has its mutex locked, the function unconditionally requeues the call regardless of whether it is already on the queue. This can occur when MSG_PEEK is used (which does not dequeue the call) or when the I/O thread has already requeued it, resulting in double-queuing that corrupts the recvmsg queue structure and leads to UAF conditions or reference count underruns. Additionally, MSG_PEEK incorrectly triggers rxrpc_notify_socket() even when data remains unconsumed on the queue. The fix ensures requeuing only occurs when the call is not already queued, moves it to the front if it is, and correctly handles reference counting (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation allows a local, low-privileged attacker to corrupt the kernel's rxrpc recvmsg queue, leading to use-after-free conditions, reference count underruns, and system crashes. The primary impact is availability — an attacker can trigger a kernel panic or denial of service on affected systems. There is no direct confidentiality or integrity impact identified, and lateral movement potential is limited given the local attack vector, though kernel memory corruption could theoretically be leveraged for privilege escalation in more complex scenarios (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with at least low-privilege credentials, further limiting the attack surface.

The vulnerability is resolved in Linux kernel version 6.18.8 and later stable releases, as well as 6.19-rc7 and subsequent release candidates, via commits 2c28769a51deb6022d7fbd499987e237a01dd63a and 930114425065f7ace6e0c0630fab4af75e059ea8 (Feedly, Kernel Patch 1, Kernel Patch 2). Downstream distributions including Red Hat (RHSA-2026:9095, RHSA-2026:9112, RHSA-2026:9512, RHSA-2026:9644, RHSA-2026:10108), Amazon Linux 2, Debian, SUSE, and Slackware have issued their own security updates. Administrators should apply the latest kernel updates for their distribution promptly; as a temporary measure, restricting local user access to systems using RxRPC sockets can reduce exposure.

The vulnerability has received standard coverage across Linux distribution security channels, with Red Hat, Amazon Linux, Debian, SUSE, and Slackware all issuing advisories and updated packages. A Reddit thread in the Slackware community noted the kernel security update inclusion. No notable independent researcher commentary or significant social media discussion beyond routine patch tracking has been observed (Feedly).