Executive brief
A vulnerability was identified in the Linux kernel's rxgk component, which handles secure network communications for certain file systems. An attacker could potentially send a specially crafted network packet that causes an internal calculation error. This could lead to a system crash or unstable behavior, impacting the availability of services relying on the affected kernel.
Technical details
An integer overflow vulnerability exists in the rxgk_extract_token() function within net/rxrpc/rxgk_app.c of the Linux kernel. The root cause is an unsafe length check where a ticket length value was rounded up using xdr_round_up() before comparison, potentially leading to an overflow that bypasses bounds checks. An attacker could exploit this by providing a large ticket length in a network-delivered rxrpc packet. The fix replaces the 'round up' logic on the untrusted input with a 'round down' logic on the available buffer size (xdr_round_down), ensuring the comparison remains safe. This issue was addressed in multiple stable kernel branches in May 2026.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-22: other: Initial patch authored by David Howells
- 2026-05-27: advisory: CVE-2026-46039 published by kernel.org and NVD
- 2026-05-07: patched: Patches committed to stable kernel trees