CVE-2026-45998: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45998 Overview

CVE-2026-45998 is a use-after-free vulnerability in the Linux kernel's rxrpc networking subsystem. The flaw resides in the rxrpc_input_packet() function, which handles incoming RxRPC protocol packets. When skb_unshare() fails due to a memory allocation failure, the socket buffer (skb) pointer held by the parent rxrpc_io_thread() is set to NULL. A subsequent call to trace_rxrpc_rx_done() then operates on the invalid pointer, leading to a kernel oops and potential memory corruption. The issue affects systems using AF_RXRPC sockets, commonly associated with AFS distributed filesystem deployments.

Critical Impact
An allocation failure during RxRPC packet processing can trigger a kernel-level use-after-free, resulting in denial of service or potential memory safety violations within kernel context.

Affected Products

Linux kernel versions containing the rxrpc subsystem prior to the upstream fix
Linux stable kernel branches receiving the backported patches referenced in the kernel.org commits
Distributions shipping the affected kernel revisions with AF_RXRPC support enabled

Discovery Timeline

2026-05-27 - CVE-2026-45998 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45998

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] condition in the RxRPC packet input path of the Linux kernel. rxrpc_input_packet() accepts a pointer-to-pointer to an sk_buff and invokes skb_unshare() to ensure exclusive ownership of the buffer before further processing. When skb_unshare() fails because of an allocation failure, it frees the original buffer and returns NULL. The caller's skb pointer in rxrpc_io_thread() is then nullified, but later code paths, including trace_rxrpc_rx_done(), still reference the buffer and dereference invalid memory.

Root Cause

The root cause is improper lifetime management of the sk_buff across the unshare boundary. skb_unshare() can release the original buffer on failure, leaving the caller with a dangling reference. The upstream fix relocates the unshare operation deeper in the call stack to rxrpc_input_call_event() where rxrpc_input_call_packet() is invoked. This change avoids unsharing packets that would be discarded anyway (for example, DATA packets for already-complete calls) and ensures the parent thread no longer holds a pointer that may be invalidated.

Attack Vector

Triggering the condition requires inducing an allocation failure inside skb_unshare() while RxRPC traffic is being processed by the kernel. This typically occurs under memory pressure on hosts that accept RxRPC traffic, such as AFS clients or servers. A remote sender of crafted RxRPC packets combined with constrained kernel memory could reach the faulty code path. The patch additionally simplifies the function signature, changing the pointer-to-pointer argument to a single pointer because the in-place reassignment is no longer needed.

The corrected code path is documented in the upstream kernel commit and associated stable backports.

Detection Methods for CVE-2026-45998

Indicators of Compromise

Kernel oops or panic messages referencing rxrpc_input_packet, rxrpc_io_thread, or trace_rxrpc_rx_done in dmesg and system logs
Unexpected kernel crashes on hosts running AFS clients or applications using AF_RXRPC sockets under memory pressure
skb_unshare allocation failure warnings preceding RxRPC-related stack traces

Detection Strategies

Monitor kernel ring buffer output for stack traces involving the rxrpc call chain after socket buffer operations
Inventory hosts with CONFIG_AF_RXRPC enabled and correlate kernel versions against the fixed stable releases referenced on kernel.org
Track abnormal kernel memory pressure events that coincide with RxRPC network activity on AFS infrastructure

Monitoring Recommendations

Forward /var/log/kern.log and journald kernel facility entries to a centralized logging or SIEM platform for stack trace pattern matching
Alert on repeated Out of memory or page allocation failure events on systems exposing RxRPC services
Track kernel package versions across the fleet to confirm patched builds are deployed on AFS-dependent systems

How to Mitigate CVE-2026-45998

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution that includes the rxrpc fix
Identify hosts using AF_RXRPC and AFS workloads and prioritize them for patching
Reboot affected systems after package upgrades to load the corrected kernel

Patch Information

The fix moves skb_unshare() invocation from rxrpc_input_packet() to the path where rxrpc_input_call_event() calls rxrpc_input_call_packet(). Multiple stable branches received backports. Reference commits include 1f274015, 8fde6296, 996b0487, bf20f46d, and e3bf143b.

Workarounds

Where RxRPC is not required, disable or blocklist the rxrpc kernel module using modprobe configuration
Restrict inbound RxRPC traffic at the network perimeter for hosts that do not require external AFS connectivity
Reduce memory pressure on affected systems by tuning workload placement until kernel updates are deployed

bash

# Configuration example: blocklist rxrpc where not needed
echo 'blacklist rxrpc' | sudo tee /etc/modprobe.d/blacklist-rxrpc.conf
sudo update-initramfs -u
# Verify kernel version after upgrade
uname -r