Executive brief
A vulnerability was identified in the Linux kernel's networking component responsible for the RxRPC protocol. This issue involves a memory leak during the verification of security responses, which could lead to a gradual depletion of system memory. If exploited, this could eventually cause system instability or a denial-of-service condition, affecting the availability of services relying on this protocol.
Technical details
A memory leak vulnerability exists in the rxkad_verify_response() function within net/rxrpc/rxkad.c of the Linux kernel. The issue stems from improper error handling where allocated memory for Kerberos tickets and server keys was not consistently freed across all function exit paths. An attacker could potentially trigger these leaks by sending specially crafted RxRPC response packets that fail verification at specific stages. This is a resource exhaustion issue that can lead to a kernel memory leak. The fix involves consolidating the cleanup logic into a single epilogue and ensuring pointers are initialized to NULL to prevent double-frees or missed frees.
Affected products
- Linux Linux Kernel v2.6.11 and later
Timeline
- 2026-04-22: patched: Initial patch authored by David Howells
- 2026-05-27: disclosed: CVE-2026-46012 published
References
- https://git.kernel.org/stable/c/34f61a07e0cdefaecd3ec03bb5fb22215643678f
- https://git.kernel.org/stable/c/852b9d64cea421336579b2de3d1338dfa677e2dd
- https://git.kernel.org/stable/c/861b9a0a1823bf064a7b810d29502a9ef043f40f
- https://git.kernel.org/stable/c/c4b8f32e73eafd4a5076be890c7c8506ec04567c
- https://git.kernel.org/stable/c/c91f33fb8356dedc82bc56ce210f1a5dbee62a52