Executive brief
A vulnerability was identified in the Linux kernel's networking component responsible for handling AF_RXRPC (a protocol used by the Andrew File System). A remote attacker could send specially crafted network packets with misaligned data to trigger internal kernel warnings or improper error handling. While this primarily affects system stability and logging, it could be used to cause minor disruptions in network services.
Technical details
A vulnerability in the rxkad (Kerberos 4 equivalent) security module of the AF_RXRPC implementation in the Linux kernel allowed for improper handling of misaligned crypto lengths. Specifically, the `rxkad_verify_packet_2` function in `net/rxrpc/rxkad.c` did not ensure that packet lengths were aligned to the expected 8-byte block size before passing them to the crypto API. Additionally, the code contained a `WARN_ON_ONCE()` macro that could be triggered by remote network traffic, potentially leading to a denial-of-service or log flooding. The fix introduces `round_down(sp->len, 8)` to ensure alignment and replaces the triggerable warning with a proper protocol abort.
Affected products
- Linux Linux kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-22: patched: Initial patch authored by David Howells
- 2026-05-27: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/440d20d95e844b657a93a0b2dcc2aae155efdce6
- https://git.kernel.org/stable/c/af9271eb666d07b6f65612dc160a47f7cb5220ed
- https://git.kernel.org/stable/c/def304aae2edf321d2671fd6ca766a93c21f877e
- https://git.kernel.org/stable/c/f0d3efd03b2a9e0f1ffa6df8fcb264af3d494286
- https://git.kernel.org/stable/c/f1c6bd0cc786a8fa74829ce3c4b3673944a308f4