Executive brief
A vulnerability was identified in the Linux kernel's implementation of the RxRPC protocol, which is used for network communications. When certain security-related packets encountered temporary processing errors, they could be left in a partially decrypted state and incorrectly retried, potentially leading to communication failures or unpredictable behavior. This issue has been resolved by ensuring that such packets are discarded, forcing a clean restart of the security handshake.
Technical details
A vulnerability in the AF_RXRPC socket implementation in the Linux kernel could allow for improper handling of encrypted packets during the connection security handshake. Specifically, if an rxrpc RESPONSE packet encountered a temporary failure (such as -ENOMEM or -EAGAIN) during processing, it could be left in a partially decrypted state and then requeued for a retry. Attempting to re-decrypt already partially decrypted data is a logic error that can lead to corruption or processing failures. The fix involves discarding the problematic packet instead of requeuing it, which triggers a new CHALLENGE packet from the initiator to restart the handshake safely. This affects the rxrpc_do_process_connection function in net/rxrpc/conn_event.c.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-23: patched: Initial patch authored by David Howells
- 2026-05-27: disclosed: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/0422e7a4883f25101903f3e8105c0808aa5f4ce9
- https://git.kernel.org/stable/c/76cb9a2d252274adfae6e293a292434631a7d472
- https://git.kernel.org/stable/c/7b89868305052b94a91b708c462bc2281fa42a4a
- https://git.kernel.org/stable/c/d61482be4aae1835b78875761206241835a7510e
- https://git.kernel.org/stable/c/f55b383070170e988e4dec28be2af1714d258521