The Linux kernel's rxrpc_recvmsg_data() function calls rxrpc_verify_data() assuming that rxrpc_call.rx_dec_buffer is allocated upon successful return. However, if rxrpc_skb_priv.len is zero, rxrpc_verify_data() does not allocate rx_dec_buffer. If allocation fails, a subsequent call to skb_copy_bits() uses a NULL destination pointer, leading to a NULL pointer dereference. The vulnerability was fixed by modifying rxrpc_verify_data() to always attempt allocation of rx_dec_buffer if it is NULL, preventing the NULL pointer dereference.

This vulnerability can cause a NULL pointer dereference in the Linux kernel, potentially leading to kernel crashes or denial of service. There is no information about exploitation in the wild or privilege escalation. The impact is limited to stability and availability of the affected system.

A fix has been implemented in the Linux kernel to address this issue by ensuring rxrpc_verify_data() always attempts to allocate rx_dec_buffer if it is NULL. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the specific fixed versions and updates.