Medium 5.5Published May 8, 2026

CVE-2026-43463rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()

Updated under an hour ago (Oct 28, 2026, 6:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() rxrpc_kernel_lookup_peer() can also return error pointers in addition to NULL, so just checking for NULL is not sufficient. Fix this by: (1) Changing rxrpc_kernel_lookup_peer() to return -ENOMEM rather than NULL on allocation failure. (2) Making the callers in afs use IS_ERR() and PTR_ERR() to pass on the error code returned.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 72904d7b9bfbf2dd146254edea93958bc35bbbfe before d854c93b12f2076c564f595b41b93b02fd42a0f9; from 72904d7b9bfbf2dd146254edea93958bc35bbbfe before d55fa7cd4b19ba91b34b307d769c149e56ad0a75; 72904d7b9bfbf2dd146254edea93958bc35bbbfe builds before 54331c5dcc6d97683d7ca2788e7ef9c9505e1477; 72904d7b9bfbf2dd146254edea93958bc35bbbfe builds before 4245a79003adf30e67f8e9060915bd05cb31d142; 056fc740be000d39a7dba700a935f3bbfbc664e6; from 6.7.3 before 6.8	CNA record
linux linux_kernel linux:linux_kernel	from 6.7.3 before 6.8; from 6.8 before 6.18.19; from 6.19 before 6.19.9; 7.0; 7.0; 7.0	NVD

References

References

https://git.kernel.org/stable/c/d854c93b12f2076c564f595b41b93b02fd42a0f9
https://git.kernel.org/stable/c/d55fa7cd4b19ba91b34b307d769c149e56ad0a75	patch
https://git.kernel.org/stable/c/54331c5dcc6d97683d7ca2788e7ef9c9505e1477	patch
https://git.kernel.org/stable/c/4245a79003adf30e67f8e9060915bd05cb31d142	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.