CVE-2026-45988

rxrpc: Fix re-decryption of RESPONSE packets

At a glance

Severity
CRITICAL 9.8
EPSS
EPSS 0.46 % · percentile 39 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet gets a temporary failure during processing, it may end up in a partially decrypted state - and then get requeued for a retry. Fix this by just discarding the packet; we will send another CHALLENGE packet and thereby elicit a further response. Similarly, discard an incoming CHALLENGE packet if we get an error whilst generating a RESPONSE; the server will send another CHALLENGE.

Scores

VersionScoreVectorScored by
CVSS 3.1CRITICAL 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1CRITICAL 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)

Weaknesses (CWE)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected 17926a79320afa9b95df6b977b40cca6d8713cea < d61482be4aae1835b78875761206241835a7510e ; affected 17926a79320afa9b95df6b977b40cca6d8713cea < 7b89868305052b94a91b708c462bc2281fa42a4a ; affected 17926a79320afa9b95df6b977b40cca6d8713cea < 76cb9a2d252274adfae6e293a292434631a7d472 ; affected 17926a79320afa9b95df6b977b40cca6d8713cea < f55b383070170e988e4dec28be2af1714d258521 ; affected 17926a79320afa9b95df6b977b40cca6d8713cea < 0422e7a4883f25101903f3e8105c0808aa5f4ce9
Linux · Linuxaffected 2.6.22 ; unaffected 0 < 2.6.22 ; unaffected 6.6.140 ≤ 6.6.* ; unaffected 6.12.86 ≤ 6.12.* ; unaffected 6.18.27 ≤ 6.18.* ; unaffected 7.0.4 ≤ 7.0.*

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD