CVE-2026-23118: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23118 is a data-race vulnerability in the Linux kernel's rxrpc (RxRPC protocol) subsystem involving unsynchronized concurrent access to the ->last_tx_at transmission timestamp variable. The flaw exists between the rxrpc_peer_keepalive_worker and rxrpc_send_data_packet functions, and on 32-bit architectures additionally causes load/store tearing due to the 64-bit width of the affected variable. Affected kernel versions span 4.17 through 6.12.68 and 6.13 through 6.18.7, as well as release candidates 6.19-rc1 through 6.19-rc6. It was published on February 14, 2026, with patches added on March 18, 2026. The CVSS v3.1 base score is 4.7 (Medium) (Feedly).

The root cause is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition). The ->last_tx_at field in the rxrpc peer structure is read and written without locking by two concurrent kernel paths: rxrpc_peer_keepalive_worker reads it to determine whether a keepalive packet is needed, while rxrpc_send_data_packet writes the current time to it. Although the lockless access is functionally tolerable for approximate timestamp purposes, on 32-bit architectures the 64-bit time64_t value is subject to tearing — where a reader may observe a partially-written value. The fix changes ->last_tx_at to an unsigned int storing only the least-significant 32 bits of the timestamp, which is atomically accessible on all supported architectures and sufficient for keepalive timing up to ~68 years (Feedly, Kernel Patch).

Exploitation of this vulnerability can lead to kernel instability and availability issues, particularly on systems running 32-bit architectures where tearing of the 64-bit timestamp can produce inconsistent state reads. This may cause keepalive mechanism failures, connection management problems, and in severe cases kernel crashes or network connectivity disruptions for services relying on the RxRPC protocol. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS A:H) (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability requires local access with low privileges and high attack complexity, significantly limiting its practical exploitability. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. CVE-2026-23118 is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Patches are available in the Linux kernel stable tree. Users should upgrade to kernel version 6.12.69 or later if running kernels in the 4.17–6.12.x range, or to 6.18.8 or later if running kernels in the 6.13–6.17.x range. Patch commits are available at git.kernel.org (commits 5d5fe8b, c08cf31, and f8cf136). For systems that cannot be immediately patched, administrators should monitor for RxRPC-related network instability or kernel warnings, and prioritize patching on 32-bit architectures where the tearing risk is most acute (Feedly, Kernel Patch).