Linux Kernel EUVD-2026-25523

Exploitation requires authenticated local access to a Linux system (PR:L) running an affected kernel version with the AF_RXRPC module loaded or compiled into the kernel. The rxrpc procfs interface must be accessible to the attacker, which is the default configuration when the module is active. Specific triggering condition is the formatting of an ISATAP IPv6 address with maximum-length representation ([ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 or similar) through the rxrpc proc handlers, which requires either an active RxRPC connection with such addressing or the ability to influence network conditions/configurations that cause this address format to be logged. The vulnerability does NOT affect systems where CONFIG_AF_RXRPC is not enabled in kernel configuration, systems without the rxrpc module loaded, or network-only attack scenarios (AV:L limits to local access). User interaction is not required (UI:N). The single-byte overflow nature means reliable exploitation requires advanced kernel exploitation techniques and is not trivially automatable across diverse kernel configurations and compiler/protection settings (ASLR, stack canaries).

Real-world risk is moderate despite CVSS 7.8. The CVSS vector AV:L/AC:L/PR:L indicates local access with low-privileged authenticated user required, significantly limiting attack surface compared to network-reachable vulnerabilities. EPSS score of 0.02% (4th percentile) suggests extremely low probability of mass exploitation, consistent with the specialized nature of AF_RXRPC usage (primarily AFS deployments). Not listed in CISA KEV, indicating no confirmed active exploitation. However, the technical impact is severe (C:H/I:H/A:H) - successful exploitation could achieve memory corruption, information disclosure, and potentially privilege escalation within kernel context. The single-byte overflow makes reliable exploitation non-trivial but feasible for skilled attackers. Primary risk is to systems running AFS or other RxRPC-dependent services where authenticated local users exist. The availability of vendor patches across stable kernel branches (6.18.23, 6.19.13, 7.0) reduces residual risk for organizations with active patch management. Priority should be moderate for AFS deployments, lower for general-purpose systems where rxrpc module is unused or not loaded.

A low-privileged authenticated user on a Linux system with AF_RXRPC enabled triggers procfs address formatting by accessing /proc/net/rxrpc entries or causing the kernel to format RxRPC connection data. By controlling or triggering network conditions that result in an ISATAP-format IPv6 address with maximum-length components and port number, the attacker causes a single-byte stack buffer overflow in the kernel's rxrpc proc handler. Through careful heap/stack manipulation techniques, the overflow corrupts adjacent kernel memory structures, potentially overwriting return addresses or function pointers to redirect execution to attacker-controlled code running with kernel privileges, achieving local privilege escalation from low-privileged user to root.