The Linux kernel's rxrpc_input_ackall() function did not properly check the call state before accepting ACKALL packets, allowing a forged ACKALL to reach a new service call in RXRPC_CALL_SERVER_RECV_REQUEST state before any reply packets were queued. In this state, call->tx_top is zero and call->tx_queue is NULL, causing rxrpc_rotate_tx_window() to dereference a NULL pointer, resulting in a kernel null-pointer dereference. The patch added two new call states (RXRPC_CALL_CLIENT_PRE_SEND and RXRPC_CALL_CLIENT_AWAIT_ACK) to track transmission progress more accurately, adjusted the ACKALL handler to check for appropriate call states including AWAIT_ACK, and changed the handler to use call->tx_transmitted instead of call->tx_top for sequence tracking. These changes prevent processing ACKALL packets in invalid states and avoid the null-pointer dereference.

This vulnerability can cause a kernel null-pointer dereference leading to a denial of service (system crash or kernel panic) if a forged ACKALL packet is processed in an invalid call state. There is no indication of privilege escalation or information disclosure. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to address this issue by improving call state tracking and ACKALL packet validation. Users should update to the fixed kernel version once available. Patch status is not yet confirmed from the vendor advisory; check the official Linux kernel security advisories or distribution updates for the specific patch and remediation guidance.