Executive brief
A vulnerability was identified in the Linux kernel's implementation of the rxrpc protocol, which is used for network communications. An attacker could potentially exploit this flaw to cause a system crash or instability by sending specially crafted network packets. This could lead to a denial-of-service condition, impacting the availability of affected systems.
Technical details
The vulnerability exists in the rxgk_yfs_decode_ticket() and rxgk_extract_token() functions within net/rxrpc/rxgk_app.c. It is caused by an 'untrusted unsigned subtract' where the code fails to properly validate the length of incoming ticket and token data before performing subtraction operations. This lack of bounds checking can result in an integer underflow or out-of-bounds write (CWE-787). An attacker can trigger this by providing a packet with a length shorter than expected by the protocol's security class implementation. The issue has been resolved by adding explicit length pre-checks and using sizeof() for consistent structure size validation. Patches are available in the stable kernel tree.
Affected products
- Linux Linux Kernel 6.16 to 6.16.9, 6.17-rc1 to 6.17-rc6
Timeline
- 2025-09-12: patched: Initial fix authored by David Howells
- 2025-10-09: disclosed: CVE-2025-39962 published