CVE-2026-45988: Linux Kernel Packet Decryption Vulnerability

CVE-2026-45988 Overview

CVE-2026-45988 affects the Linux kernel's rxrpc subsystem, which implements the RxRPC transport protocol used by AFS and Kerberos-style authenticated remote procedure calls. The flaw resides in how the kernel handles RESPONSE packets that encounter a temporary failure during processing. When such a failure occurs, the packet can be left in a partially decrypted state and then requeued for retry, leading to incorrect cryptographic state during subsequent processing.

A similar condition exists for incoming CHALLENGE packets that fail while a RESPONSE is being generated. The upstream fix discards the affected packets and relies on the peer to send another CHALLENGE, restoring the expected authentication handshake flow.

Critical Impact
Incorrect re-decryption of partially processed RxRPC RESPONSE packets can corrupt authentication state in kernel networking code, leading to protocol failures or undefined behavior during the RxRPC challenge-response handshake.

Affected Products

Linux kernel versions containing the rxrpc subsystem prior to the fix commits
Distributions shipping the affected net/rxrpc code path
Systems using AFS or other RxRPC-dependent services

Discovery Timeline

2026-05-27 - CVE-2026-45988 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45988

Vulnerability Analysis

The rxrpc subsystem implements an authenticated challenge-response handshake. When the server sends a CHALLENGE packet, the client replies with a RESPONSE packet that the server must decrypt and validate. The flaw occurs when decryption or validation of a RESPONSE packet hits a transient error such as a memory allocation failure.

Instead of resetting cryptographic state, the kernel requeues the same packet for a retry. By that point, portions of the packet payload have already been transformed by the partial decryption operation. Re-running the decryption routine over partially decrypted data produces incorrect output and inconsistent authentication state inside the kernel.

The upstream patch addresses both directions of the handshake. RESPONSE packets that hit a temporary failure are discarded, and the server emits a fresh CHALLENGE to restart the handshake. Likewise, CHALLENGE packets that fail while a RESPONSE is being generated are discarded so the peer can retransmit cleanly.

Root Cause

The root cause is improper handling of transient errors during RESPONSE packet processing in net/rxrpc. The retry path did not account for the fact that the packet buffer had already been mutated by an in-place decryption attempt, causing repeated decryption over the same buffer.

Attack Vector

The affected code path is reachable over the network from any peer that can initiate an RxRPC session with the host. Triggering the condition requires inducing a temporary failure such as resource pressure during RESPONSE handling. No verified proof-of-concept code is available, and the issue is resolved by discarding the partially processed packet rather than retrying it.

The vulnerability is described in prose only. See the Kernel Commit 0422e7a and Kernel Commit f55b383 for the exact code changes.

Detection Methods for CVE-2026-45988

Indicators of Compromise

Unexpected RxRPC authentication failures or repeated CHALLENGE/RESPONSE cycles in kernel logs.
Kernel warnings or error messages originating from functions in net/rxrpc related to packet decryption.
Anomalous patterns of AFS or Kerberos-authenticated RPC session resets on affected hosts.

Detection Strategies

Inventory Linux kernel versions across the fleet and compare against the patched commit hashes referenced by the upstream fix.
Monitor dmesg and journal output for rxrpc subsystem errors that correlate with periods of memory pressure.
Track network telemetry for repeated RxRPC handshake restarts originating from the same peer.

Monitoring Recommendations

Enable kernel tracing on rxrpc events where AFS or other RxRPC services are in use.
Correlate kernel resource-pressure events with RxRPC handshake anomalies in centralized logging.
Alert on unusual rates of CHALLENGE retransmissions toward Linux servers that expose RxRPC endpoints.

How to Mitigate CVE-2026-45988

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 0422e7a, 76cb9a2, 7b89868, d61482b, and f55b383.
Update to the distribution-provided stable kernel that incorporates the rxrpc RESPONSE re-decryption fix.
Reboot affected hosts after kernel installation to load the patched code paths.

Patch Information

The fix is available in the upstream Linux stable tree. Refer to Kernel Commit 0422e7a, Kernel Commit 76cb9a2, Kernel Commit 7b89868, Kernel Commit d61482b, and Kernel Commit f55b383 for the specific changes. The patch discards partially processed RESPONSE and CHALLENGE packets so the handshake restarts cleanly.

Workarounds

Disable or unload the rxrpc kernel module on hosts that do not require AFS or other RxRPC-based services.
Restrict network access to RxRPC ports using host or perimeter firewalls until the patched kernel is deployed.
Reduce conditions that cause transient processing failures by ensuring adequate memory headroom on affected hosts.

bash

# Verify whether the rxrpc module is loaded and unload if unused
lsmod | grep rxrpc
sudo modprobe -r rxrpc

# Prevent automatic loading
echo 'blacklist rxrpc' | sudo tee /etc/modprobe.d/blacklist-rxrpc.conf