Junglewise Threat Intelligence

CVE-2026-45998: Linux kernel use-after-free in rxrpc protocol handler

CVE-2026-45998 · Severity: info · CVSS 5.5 · Published 2026-05-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's implementation of the RxRPC protocol, which is used for network communications. Under specific conditions involving high memory pressure, the system may experience a crash (kernel oops) when processing incoming network packets. This could lead to a denial-of-service state, impacting the availability of services relying on this protocol.

Technical details

A potential use-after-free (UAF) and NULL pointer dereference exists in the Linux kernel's rxrpc protocol implementation. The vulnerability occurs in rxrpc_input_packet() when skb_unshare() fails due to memory allocation failure (OOM). In this scenario, the skb pointer in the parent rxrpc_io_thread() is NULL'd out, leading to a kernel oops when trace_rxrpc_rx_done() is subsequently called. The fix involves moving the unsharing logic to rxrpc_input_call_event() to ensure that unsharing is only attempted when necessary and that failures are handled gracefully without corrupting parent pointers. Patch availability is confirmed across multiple stable kernel branches.

Affected products

  • Linux Linux kernel n/a

Timeline

  • 2026-04-22: patched: Initial patch by David Howells
  • 2026-05-27: disclosed: CVE-2026-45998 published

References

Related threats