Cloudanix VulnDB

CVE-2026-23118

Medium · 4.7

CVSS

4.7

EPSS

0.1%

Published

Feb 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing bug in Linux network code that could cause occasional incorrect keepalive decisions on older 32-bit machines has been corrected.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Data race on conn->peer->last_tx_at in rxrpc_peer_keepalive_worker and rxrpc_send_data_packet allowing potential load/store tearing on 32-bit architectures due to unsynchronized 64-bit time64_t accesses.

Why it matters to the business

Low operational risk limited to kernel debug warnings or minor RXRPC keepalive timing inaccuracy on 32-bit systems; no widespread disruption or data loss expected.

How an attack unfolds

An attacker would need local access to trigger concurrent RXRPC send and keepalive paths while a KCSAN-enabled kernel is running; the race itself is informational only and does not grant privilege escalation or remote code execution.

How to fix it

Upgrade the Linux kernel to the commit c08cf314191cd0f8699089715efb9eff030f0086 or later stable releases that replace last_tx_at with an unsigned int storing only the least-significant word of the time value.

How to confirm the fix worked

Verify the running kernel contains commit c08cf314191cd0f8699089715efb9eff030f0086; confirm absence of KCSAN warnings mentioning rxrpc_peer_keepalive_worker or last_tx_at under concurrent RXRPC load.

Typical attack path

  1. Obtain local unprivileged access on a 32-bit Linux system using RXRPC
  2. Exercise concurrent rxrpc_send_data_packet and rxrpc_peer_keepalive_worker paths
  3. Observe KCSAN data-race report or potential time-value tearing

How to detect it

Search kernel logs for KCSAN BUG reports referencing rxrpc_peer_keepalive_worker or rxrpc_send_data_packet; inspect for repeated last_tx_at accesses without locks.

  • KCSAN: data-race in rxrpc_peer_keepalive_worker
  • rxrpc_send_data_packet
  • conn->peer->last_tx_at

What your security team should do

  • Apply the referenced kernel commit or newer stable branch within normal patch windows
  • Enable KCSAN on test systems that exercise RXRPC to validate the fix
  • Monitor EPSS trend; reassess if score rises above 0.01

The record

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix data-race warning and potential load/store tearing Fix the following: BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet which is reporting an issue with the reads and writes to ->last_tx_at in: conn->peer->last_tx_at = ktime_get_seconds(); and: keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME; The lockless accesses to these to values aren't actually a problem as the read only needs an approximate time of last transmission for the purposes of deciding whether or not the transmission of a keepalive packet is warranted yet. Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit arch. Fix both of these by switching to an unsigned int for ->last_tx_at and only storing the LSW of the time64_t. It can then be reconstructed at need provided no more than 68 years has elapsed since the last transmission.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.17.0 6.12.69

Related vulnerabilities