Skip to main content

Linux Kernel CVE-2026-45988

| EUVDEUVD-2026-32284 CRITICAL
Incorrect Calculation (CWE-682)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-prrp-jq4x-wwq4
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Linux host running rxrpc/kAFS
  2. Delivery
    Initiate RxRPC authentication handshake
  3. Exploit
    Trigger transient decryption failure on RESPONSE
  4. Execution
    Force requeue of partially decrypted packet
  5. Persist
    Abuse inconsistent crypto state
  6. Impact
    Extract sensitive handshake data or destabilize service

Vulnerability Assessment

Weakness
CWE
CWE-682
ASVS 5.0
V15 - Secure Coding and Architecture Calculation correctness
Exploitation Conditions

Exploitation requires the target Linux host to have the rxrpc subsystem in use (CONFIG_AF_RXRPC compiled and the rxrpc module loaded), which in practice means an AFS client or server (kAFS) deployment; rxrpc is not active on default desktop or server installs. The attacker must be able to reach the rxrpc UDP service from the network and induce a temporary failure during RESPONSE packet decryption (typically a transient resource error) so the partially decrypted packet is requeued. Limiting factors include the rarity of AFS in modern environments, the need to time or provoke transient processing errors, and that the vulnerable path is the CHALLENGE/RESPONSE handshake rather than steady-state data flow.
Impact

The headline CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world risk for this issue. EPSS at 0.02% (5th percentile) and absence from CISA KEV indicate no observed exploitation and very low probability of weaponization. The 'Information Disclosure' tag, the limited use of RxRPC in modern Linux deployments (primarily AFS clients/servers), and the requirement for an in-flight authentication handshake with transient processing failures all argue against the AV:N/AC:L/C:H/I:H/A:H scoring being representative. The CVSS vector and the description's emphasis on retry/discard logic appear inconsistent - the described impact looks more like a state-handling bug than a straightforward remote unauthenticated RCE, and the CVSS rating should be treated with skepticism pending independent analysis. Prioritize patching only on systems that actively use AFS/rxrpc.
Exploit ScenarioDerived

An attacker on a network path to a Linux host with kAFS/rxrpc enabled triggers an authentication handshake and induces transient processing failures (e.g., memory pressure) so that RESPONSE packets enter a partially decrypted state and are requeued. Repeated abuse of the inconsistent cryptographic state could theoretically expose handshake material or destabilize the rxrpc state machine. No proof-of-concept code has been published and exploitation would require the target to actively use rxrpc, which is uncommon outside AFS deployments.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 30, 2026

Improper handling of failed RESPONSE packet decryption in the Linux kernel's rxrpc subsystem can leave packets in a partially decrypted state when requeued for retry after a temporary processing failure. The flaw affects multiple Linux kernel branches and was resolved upstream by discarding such packets and relying on the CHALLENGE/RESPONSE re-handshake. No public exploit identified at time of analysis, and EPSS scoring (0.02%, 5th percentile) indicates very low real-world exploitation probability despite the high CVSS rating.

RemediationAI

Vendor-released patches are available: upgrade to Linux kernel 6.6.140, 6.12.86, 6.18.27, 7.0.4, or 7.1-rc1 (or any later release on those branches) using the stable commits referenced at https://git.kernel.org/stable/c/d61482be4aae1835b78875761206241835a7510e and the companion commits listed in the references. If a kernel upgrade cannot be scheduled, the most effective compensating control is to disable or unload the rxrpc module (modprobe -r rxrpc and blacklist in /etc/modprobe.d/) on hosts that do not require AFS or kAFS - the trade-off is loss of in-kernel AFS client/server functionality, which is acceptable for the vast majority of servers and workstations. Distribution-specific advisories should be consulted as they ship backports (Red Hat, SUSE, Ubuntu, Debian).

Affected VersionsENISA

Linux 17926a79320afa9b95df6b977b40cca6d8713cea <d61482be4aae1835b78875761206241835a7510e
Linux patch: 6.12.86
Linux patch: 6.6.140
Linux 17926a79320afa9b95df6b977b40cca6d8713cea <7b89868305052b94a91b708c462bc2281fa42a4a
Linux patch: 0
Linux 17926a79320afa9b95df6b977b40cca6d8713cea <0422e7a4883f25101903f3e8105c0808aa5f4ce9
Linux patch: 7.0.4
Linux 2.6.22
Linux patch: 6.18.27
Linux 17926a79320afa9b95df6b977b40cca6d8713cea <76cb9a2d252274adfae6e293a292434631a7d472
Linux 17926a79320afa9b95df6b977b40cca6d8713cea <f55b383070170e988e4dec28be2af1714d258521
Linux patch: 7.1-rc1

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in net/rxrpc, the kernel implementation of the RxRPC transport protocol historically used by AFS (Andrew File System) and Kerberos-style authentication exchanges. The RxRPC authentication handshake uses CHALLENGE and RESPONSE packets that are cryptographically processed; if RESPONSE decryption encounters a temporary failure (e.g., memory pressure or transient resource exhaustion), the existing code retained the half-processed packet and requeued it, potentially leading to inconsistent cryptographic state. The fix, landed across stable branches per the kernel.org commits referenced, discards partially processed CHALLENGE/RESPONSE packets so the peer simply retransmits a fresh CHALLENGE. No CWE was assigned, but the bug class aligns with improper state management during cryptographic processing (CWE-755-adjacent).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE CRITICAL
Red Hat 5.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
May 30, 2026 - 11:22 NVD
9.8 (CRITICAL)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix re-decryption of RESPONSE packets

If a RESPONSE packet gets a temporary failure during processing, it may end up in a partially decrypted state - and then get requeued for a retry.

Fix this by just discarding the packet; we will send another CHALLENGE packet and thereby elicit a further response. Similarly, discard an incoming CHALLENGE packet if we get an error whilst generating a RESPONSE; the server will send another CHALLENGE.

Executive ViewAI

Why It Matters

Linux kernel vulnerability CVE-2026-45988 (CRITICAL CVSS 9.8) affects the rxrpc subsystem with potential for data corruption or denial of service. However, real-world exploitation probability is extremely low (0.02% EPSS, 5th percentile) with no identified public exploits, making this a lower-urgency patching priority despite the technical severity rating.

Business Impact: Low
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Low

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-682 – Incorrect Calculation

View all
CVE-2021-44847 CRITICAL POC
9.8
CVE-2022-23066 CRITICAL POC
9.1
CVE-2022-28048 HIGH POC
8.8
CVE-2020-0022 HIGH POC
8.8
CVE-2019-16346 HIGH POC
8.8
CVE-2023-42460 HIGH POC
7.5
CVE-2022-22138 HIGH POC
7.5
CVE-2022-30780 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-45988 ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://ubuntu.com/security/notices/USN-8489-1 ADVISORY https://vuldb.com/vuln/366198 REF https://git.kernel.org/stable/c/0422e7a4883f25101903f3e8105c0808aa5f4ce9 REF https://git.kernel.org/stable/c/76cb9a2d252274adfae6e293a292434631a7d472 REF https://git.kernel.org/stable/c/7b89868305052b94a91b708c462bc2281fa42a4a REF https://git.kernel.org/stable/c/d61482be4aae1835b78875761206241835a7510e REF https://git.kernel.org/stable/c/f55b383070170e988e4dec28be2af1714d258521

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy