Linux Kernel CVE-2026-46012

Exploitation requires: (1) local system access with at least low-privilege credentials (PR:L per CVSS - an unprivileged shell account suffices); (2) the rxrpc kernel module loaded and active, which occurs only on AFS client deployments - rxrpc is not loaded by default on standard Linux distributions; (3) the rxkad Kerberos authentication path engaged, meaning AFS Kerberos authentication must be configured and in use; and (4) the ability to repeatedly invoke authentication operations to accumulate leaked memory over time. Remote exploitation is not possible (AV:L). There is no confidentiality or integrity exposure - impact is limited to availability via kernel memory exhaustion. Standard desktop, server, or cloud Linux instances that do not run an AFS client are not exposed to this vulnerability.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately characterizes this as a local, low-privilege, availability-only issue. The EPSS score of 0.02% at the 5th percentile is consistent with the constrained exploitation path - this subsystem is not widely exercised. The CVE is not listed in the CISA KEV catalog, and no public proof-of-concept has been identified, making real-world exploitation even less probable. Critically, rxrpc and rxkad are not loaded or active on most general-purpose Linux deployments; only systems operating as AFS clients with Kerberos authentication configured are actually exposed. The impact ceiling is an out-of-memory denial of service requiring sustained, repeated local triggering - not a single-shot remote exploit. This is a legitimate medium-severity bug to patch in the next maintenance window but does not warrant emergency response for the vast majority of deployments.

A local user with a standard low-privilege shell account on an AFS-enabled Linux host repeatedly invokes Kerberos authentication operations through the rxrpc subsystem, triggering error return paths inside rxkad_verify_response() that exit without freeing ticket or server key allocations. Sustained invocation accumulates leaked kernel memory until the system hits an out-of-memory condition, potentially crashing the host or triggering the OOM killer against critical services. No public proof-of-concept exploit has been identified; achieving reliable exploitation requires knowledge of rxrpc internals and persistent local access.