Linux Kernel CVE-2026-46000

RxRPC (Reliable RPC over UDP, AF_RXRPC) is the Linux kernel protocol underlying the AFS distributed file system. Socket buffers (sk_buff) in the Linux networking stack can be cloned - reference-counted structures sharing the same underlying data region - by kernel subsystems such as AF_PACKET sniffers, netfilter hooks, or packet monitoring infrastructure. A fundamental copy-on-write invariant requires that any writer call skb_unshare() or skb_cow_data() before modifying a potentially cloned sk_buff. The rxrpc security operations that process RESPONSE packets (which carry authentication tokens and cryptographic handshake data for the RxRPC security layer) decrypt the payload in-place without first checking whether the sk_buff has been cloned. This violation of COW semantics causes the write to appear across all holders of the shared buffer, meaning any co-resident packet sniffer receives the decrypted - and from its perspective structurally corrupted - frame. While no CWE is formally assigned, the flaw most closely aligns with CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) or CWE-666 (Operation on Resource in Wrong Phase of Lifetime). The fix conditionally copies the sk_buff before passing it to the security handler when a clone is detected. The vulnerable code range runs from commit 17926a79320afa9b95df6b977b40cca6d8713cea (introduced in Linux 2.6.22) up to the per-branch fix commits.