Executive brief
A vulnerability was identified in the Linux kernel's rxrpc network protocol implementation. The issue involves improper error handling during the extraction of security tokens, which could lead to unexpected behavior or system instability when the system runs out of memory. This affects the reliability of secure network communications managed by the rxrpc protocol.
Technical details
A vulnerability in the Linux kernel's rxrpc protocol implementation was discovered in the rxgk_extract_token() function within net/rxrpc/rxgk_app.c. The function failed to properly handle the -ENOMEM error returned by rxgk_decrypt_skb(). Instead of returning the error to the caller, the code would continue execution, potentially leading to undefined behavior or kernel panics under memory pressure. This is a logic error in the error-handling path of the GSS-API Kerberos (rxgk) security layer for rxrpc. Patches have been released to ensure the function returns immediately upon encountering a memory exhaustion error.
Affected products
- Linux Linux Kernel 6.14 and earlier
Timeline
- 2026-04-23: patched: Initial fix authored by David Howells
- 2026-05-27: disclosed: CVE-2026-46010 published