Executive brief
A vulnerability was identified in the Linux kernel's implementation of the RxRPC protocol, which is used for network communications. Under specific conditions involving high memory pressure, the system may experience a crash (kernel oops) when processing incoming network packets. This could lead to a denial-of-service state, impacting the availability of services relying on this protocol.
Technical details
A potential use-after-free (UAF) and NULL pointer dereference exists in the Linux kernel's rxrpc protocol implementation. The vulnerability occurs in rxrpc_input_packet() when skb_unshare() fails due to memory allocation failure (OOM). In this scenario, the skb pointer in the parent rxrpc_io_thread() is NULL'd out, leading to a kernel oops when trace_rxrpc_rx_done() is subsequently called. The fix involves moving the unsharing logic to rxrpc_input_call_event() to ensure that unsharing is only attempted when necessary and that failures are handled gracefully without corrupting parent pointers. Patch availability is confirmed across multiple stable kernel branches.
Affected products
- Linux Linux kernel n/a
Timeline
- 2026-04-22: patched: Initial patch by David Howells
- 2026-05-27: disclosed: CVE-2026-45998 published
References
- https://git.kernel.org/stable/c/1f2740150f904bfa60e4bad74d65add3ccb5e7f8
- https://git.kernel.org/stable/c/8fde6296c4d4da2be7ab761305ab7f232b94eefd
- https://git.kernel.org/stable/c/996b0487b3cdda4c91811dbb1c9564626bc840bd
- https://git.kernel.org/stable/c/bf20f46d94f1db38e6ffc0ca204a5fe0de01b495
- https://git.kernel.org/stable/c/e3bf143b1e98fb3d6d9e6825bcd683974d478e8c