Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-23066

CVE-2026-23066MEDIUM

Linux Linux — rxrpc: Fix recvmsg() unconditional requeue

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  N  N  H    5.5   .0015    3.9     —

AFFECTED
  Product  Versions                                    Fixed
  Linux    540b1c48c37ac0ad66212004db21e1ff7e2d78be –  —
  Linux    4.11 –                                      5.10.258

TIMELINE
  Jan 13  Reserved by Linux
  Feb 4   Published (CNA: Linux)
  Oct 15  RESCORED — CVE-2026-23066 (Linux). CVSS 7.8 → 5.5 (NVD).

CWE-674 · CNA: Linux · CVSS v3.1 · 8 references · NVD status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recvmsg() unconditional requeue If rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues the call - whether or not the call is already queued. The call may be on the queue because MSG_PEEK was also passed and so the call was not dequeued or because the I/O thread requeued it. The unconditional requeue may then corrupt the recvmsg queue, leading to things like UAFs or refcount underruns. Fix this by only requeuing the call if it isn't already on the queue - and moving it to the front if it is already queued. If we don't queue it, we have to put the ref we obtained by dequeuing it. Also, MSG_PEEK doesn't dequeue the call so shouldn't call rxrpc_notify_socket() for the call if we didn't use up all the data on the queue, so fix that also.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 13, 2026	Reserved	Reserved by Linux
February 4, 2026	Published	Published (CNA: Linux)
October 15, 2026	RESCORED	RESCORED — CVE-2026-23066 (Linux). CVSS 7.8 → 5.5 (NVD).

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Linux	Linux	—	540b1c48c37ac0ad66212004db21e1ff7e2d78be	—
Linux	Linux	—	4.11	5.10.258

Weaknesses

CWE-674

References (8)

Authoritative record: CVE-2026-23066 at cve.org

Vendors: linux

Weaknesses: CWE-674

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-23066 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.