CVE-2026-74432: rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)

Fix rxrpc_recvmsg() to also drop the ref it holds on an already-released
call if MSG_PEEK is in force (the function holds a ref on the call
irrespective of whether MSG_PEEK is specified or not).

The Linux kernel CVE team has assigned CVE-2026-74432 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6.100 with commit 7692bde890061797f3dece0148d7859e85c55778 and fixed in 6.6.145 with commit 86eff3140c9d4b52bba13d1cba266da933403e51
	Issue introduced in 6.12.40 with commit 839fe96c15209dc2255c064bb44b636efe04f032 and fixed in 6.12.97 with commit e473cd3046a1aaec1e39af5df2042ce7c04d5e74
	Issue introduced in 6.16 with commit 962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc and fixed in 6.18.40 with commit 2b69b61057eb0b3db9ad754ef0f1436b7af3a9f5
	Issue introduced in 6.16 with commit 962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc and fixed in 7.1.5 with commit 04c7103dc0923cc6ac95b97aa66bab70da7ace84
	Issue introduced in 6.16 with commit 962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc and fixed in 7.2-rc1 with commit 4bdb9e471f5b1ac9cbe4add5de7ff085a0ec303c
	Issue introduced in 6.15.8 with commit 6c75a97a32a5fa2060c3dd30207e63b6914b606d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74432
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/rxrpc/recvmsg.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/86eff3140c9d4b52bba13d1cba266da933403e51
	https://git.kernel.org/stable/c/e473cd3046a1aaec1e39af5df2042ce7c04d5e74
	https://git.kernel.org/stable/c/2b69b61057eb0b3db9ad754ef0f1436b7af3a9f5
	https://git.kernel.org/stable/c/04c7103dc0923cc6ac95b97aa66bab70da7ace84
	https://git.kernel.org/stable/c/4bdb9e471f5b1ac9cbe4add5de7ff085a0ec303c