Executive brief
A vulnerability in the Linux kernel's networking component could allow an attacker to compromise a system by sending specially crafted network packets. The issue exists in the way the system handles encrypted authentication tickets for the RxRPC protocol, which is used for certain types of network communications. An exploit could lead to unauthorized access, data theft, or a complete system takeover.
Technical details
A vulnerability in rxkad_decrypt_ticket() within the Linux kernel's rxrpc implementation occurs because the function fails to check the return value of crypto_skcipher_decrypt(). An attacker can provide a malformed RESPONSE packet with a non-block-aligned ticket length, causing the decryption operation to fail. Because the failure is ignored, the function proceeds to parse the buffer as if it were valid plaintext, using attacker-controlled bytes to drive the ticket parser. This can lead to memory corruption or authentication bypass. The issue has been resolved by adding a check for the decryption result and aborting the connection if it fails.
Affected products
- Linux Linux Kernel versions from 2.6.22.1 up to 6.6.135, 6.7 up to 6.12.82, 6.13 up to 6.18.23, 6.19 up to 6.19.13
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-04-18: patched
References
- https://git.kernel.org/stable/c/22f6258e7b31dba9bf88dce4e3ee7f0f20072e60
- https://git.kernel.org/stable/c/252157d939d179b5d767cb860ff8fa7f8723b67a
- https://git.kernel.org/stable/c/47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8a
- https://git.kernel.org/stable/c/58fcd1b156152613ba00a064a129fb69507ddd7d
- https://git.kernel.org/stable/c/a149dcae23309df9de1c3b6b5d468610ef5ab7de
- https://git.kernel.org/stable/c/a75b3b361dd481d942c5f259a82d59718a41092c
- https://git.kernel.org/stable/c/b3a808cd0790b5075aaa2bc3588edf02cd71d352