EUVD-2026-59576
GHSA-p3f2-6553-5mwv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attacker must control or impersonate the AFS server to deliver the premature reply, requiring MITM or server compromise, elevating AC to H; no confidentiality or integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix the reception of a reply packet before data transmission
Fix rxrpc_receiving_reply() to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call by checking to see if the call has been exposed yet by sending the first packet.
Without this, rxrpc_rotate_tx_window() might oops.
Also fix rxrpc_rotate_tx_window() to handle the Tx queue being empty by changing the do...while loop into a while loop, just in case a call is abnormally terminated by an early reply before the last request packet is transmitted.
AnalysisAI
Kernel panic via rxrpc protocol mishandling in the Linux kernel allows a network-positioned attacker to crash an AFS client system by sending a premature reply DATA packet before any request packets have been transmitted on a client call. The flaw resides in rxrpc_receiving_reply(), which fails to verify call exposure state before invoking rxrpc_rotate_tx_window() - a function whose do...while loop oopses on an empty transmit queue. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target system must be actively running an AFS filesystem client that uses the rxrpc protocol - this is a non-default Linux configuration requiring explicit installation and mounting of AFS volumes (via the kafs or openafs kernel modules). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-accessible, unauthenticated denial-of-service with high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operating a malicious AFS server - or conducting a man-in-the-middle attack on AFS UDP traffic - waits for a Linux AFS client to initiate an rxrpc client call, then immediately injects or returns a reply DATA packet before the client has transmitted any request DATA packets. This premature reply reaches rxrpc_receiving_reply() while the call is in the unexposed state, triggering rxrpc_rotate_tx_window() against an empty transmit queue, causing a kernel oops and crashing the target system. … |
| Remediation | Update the Linux kernel to a patched stable release: 7.1.5 or later for the 7.x series, 6.18.40 or later for the 6.18.x series, or 7.2-rc1 or later for mainline development trees. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate all Linux systems running AFS client functionality and determine which run kernel versions prior to 7.1.5 or 6.18.40; flag internet-exposed systems for prioritized patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today