Skip to main content

Linux Kernel CVE-2026-46012

| EUVDEUVD-2026-32309 MEDIUM
Memory Leak (CWE-401)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-29h5-9g4g-x624
Linux Denial Of Service Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only kernel memory leak requiring low-privilege trigger; no confidentiality or integrity impact; high availability impact via OOM exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 16, 2026 - 15:57 vuln.today
CVSS changed
Jun 16, 2026 - 15:37 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix memory leaks in rxkad_verify_response()

Fix rxkad_verify_response() to free the ticket and the server key under all circumstances by initialising the ticket pointer to NULL and then making all paths through the function after the first allocation has been done go through a single common epilogue that just releases everything - where all the releases skip on a NULL pointer.

AnalysisAI

Memory exhaustion denial-of-service in the Linux kernel's rxkad Kerberos authentication layer allows a local low-privilege attacker to leak kernel memory by repeatedly triggering error paths in rxkad_verify_response(). The vulnerability affects kernels from approximately 5.11 through all unpatched stable series prior to 6.6.140, 6.12.86, 6.18.27, and 7.0.4. No public exploit exists and EPSS sits at 0.02% (5th percentile), indicating minimal real-world exploitation likelihood; however, systems running AFS workloads with rxrpc active warrant patching at next maintenance.

Technical ContextAI

The flaw resides in the Linux kernel's rxkad module (net/rxrpc/rxkad.c), which implements Kerberos-based authentication for the RxRPC transport protocol - used almost exclusively by the AFS (Andrew File System) distributed filesystem client. The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime): rxkad_verify_response() allocated memory for a Kerberos ticket buffer and a server key object but did not free both allocations on all error return paths. The fix initializes the ticket pointer to NULL at function entry and funnels all post-allocation exits through a single cleanup epilogue that conditionally releases both objects, skipping NULL pointers safely. The vulnerable commit range originates at ec832bd06d6fdf08b0455ab7c2a7a9104e029638 (approximately Linux 5.11) and is confirmed across four distinct stable branches by EUVD data.

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched stable release: 6.6.140, 6.12.86, 6.18.27, or 7.0.4 (or later within each branch); 7.1-rc1 also contains the fix. Upstream commits are available at the kernel.org stable links listed in the affected products section. Distribution maintainers (Red Hat, Ubuntu, SUSE, Debian) typically backport these fixes - consult your distribution's security errata before manually applying upstream patches. As an interim workaround where patching is not immediately feasible, prevent the rxrpc kernel module from loading by adding the directive 'install rxrpc /bin/true' to /etc/modprobe.d/disable-rxrpc.conf and rebooting. This completely eliminates exposure but disables all AFS Kerberos authentication; it is appropriate only for systems that do not depend on AFS.

Same weakness CWE-401 – Memory Leak

View all
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1
CVE-2023-23145 HIGH POC
7.8
CVE-2022-35858 HIGH POC
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2026-46012 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy