Linux Kernel CVE-2026-64026

Exploitation requires the target system to have the rxrpc/AF_RXRPC subsystem in use (kAFS/AFS client), an encrypted rxrpc connection so that DATA packets undergo decryption, and a local low-privileged user (CVSS PR:L) able to open an rxrpc socket and drive recvmsg() alongside a locally transmitted splice() on the same buffers - the described race between in-place DATA decryption and splice() page sharing. Limiting factors that sharply narrow real-world risk: the vector is local only (AV:L, no remote reach), it depends on the non-default and rarely-deployed rxrpc/AFS stack being present and active, and it is meaningful only for encrypted connections where decryption of shared sk_buff pages occurs.

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-privilege, no-interaction issue with high confidentiality, integrity, and availability impact - plausible for kernel pagecache corruption that can leak or damage file data. However, that severity is gated hard by exposure: rxrpc/AFS is not compiled in or loaded on the overwhelming majority of production systems, so the practical attack surface is narrow. This is corroborated by the low EPSS (0.17%, 6th percentile), absence from CISA KEV, and no known POC. There is mild tension worth flagging: the CVSS marks C:H/I:H/A:H while the intelligence tags label it only 'Information Disclosure' - the underlying pagecache corruption supports the broader integrity/availability rating, but real-world impact depends on whether an attacker can steer corruption usefully. Net: a legitimate defense-in-depth kernel fix to patch on rolling stable kernels, but a low operational priority for hosts that do not use kAFS/rxrpc.

A local user on a host running kAFS opens an encrypted rxrpc connection and concurrently issues a splice() to move locally transmitted DATA payloads while the I/O thread decrypts the shared packet buffer in place. The overlapping in-place decryption corrupts pagecache pages referenced by the splice path, allowing the attacker to disclose or damage file-backed data. No public POC is identified, and the local, low-complexity vector means exploitation is feasible only for an already-authenticated local user on an AFS-enabled system.