CVE-2026-46000: Linux Kernel Information Disclosure Bug

CVE-2026-46000 Overview

CVE-2026-46000 is a Linux kernel vulnerability in the rxrpc networking subsystem. The flaw resides in connection-level packet handling logic that processes RESPONSE packets. Security operations decrypt portions of these packets in place within the sk_buff buffer. When the sk_buff is shared with a packet sniffer such as tcpdump or AF_PACKET consumers, the sniffer observes the decrypted contents rather than the original wire data. The kernel patch addresses this by handing a copy of the packet to the specific security handler when the packet is cloned.

Critical Impact
Shared socket buffers can expose decrypted RxRPC RESPONSE packet contents to packet capture tools, breaking the data integrity expectation between wire traffic and sniffer output.

Affected Products

Linux kernel versions containing the rxrpc connection-level packet handling code prior to the fix
Stable kernel branches tracked by the referenced upstream commits
Distributions shipping kernels that include the affected rxrpc security operation paths

Discovery Timeline

2026-05-27 - CVE-2026-46000 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46000

Vulnerability Analysis

The rxrpc protocol implements the RxRPC transport used primarily by AFS (Andrew File System). During connection setup, the kernel processes RESPONSE packets that carry authentication material. The rxrpc security operations verify these packets and decrypt portions of them directly inside the sk_buff data area rather than operating on a private copy.

The Linux networking stack frequently clones sk_buff structures for delivery to multiple consumers. Packet capture interfaces such as AF_PACKET, PF_PACKET, and tcpdump receive cloned references to the same underlying packet data. When the rxrpc handler mutates the buffer in place, those shared consumers observe the modified bytes.

This category of defect falls under improper handling of shared resources and can be classified as an information exposure issue within kernel network processing.

Root Cause

The root cause is the absence of an unshare operation before in-place decryption. The rxrpc connection-level code passed the original sk_buff directly to security handlers without first calling skb_unshare() or an equivalent copy routine. Because sk_buff cloning preserves the data payload by reference, any write performed by the security handler propagated to every cloned view of the packet, including sniffer-facing references.

Attack Vector

This is a data integrity and information exposure issue rather than a remote code execution path. An observer running packet capture on a host that receives RxRPC traffic sees decrypted RESPONSE payload bytes in place of the encrypted wire content. The vulnerability does not require attacker interaction with the target. It surfaces whenever legitimate RxRPC traffic is captured alongside in-place security processing. The fix introduces a packet copy when the sk_buff is detected as cloned, ensuring decryption operates on a private buffer and leaves shared consumers with the original encrypted bytes.

The vulnerability mechanism is described in the upstream commit messages. See the Kernel Git Commit 24481a7 and Kernel Git Commit c0428a2 for the patch details.

Detection Methods for CVE-2026-46000

Indicators of Compromise

Packet captures of RxRPC RESPONSE traffic showing payload bytes that do not match expected on-wire ciphertext patterns.
Hosts running AFS clients or servers on unpatched kernels where tcpdump or other AF_PACKET consumers are active during RxRPC sessions.
Discrepancies between captured RESPONSE packet contents and the values negotiated by peer endpoints.

Detection Strategies

Inventory running kernel versions across Linux fleets and cross-reference against the fixed commits in the upstream stable tree.
Audit deployed systems for the rxrpc and kafs kernel modules being loaded, since hosts without RxRPC traffic are not exposed.
Review change management records for kernel package updates that include the referenced stable backports.

Monitoring Recommendations

Track Linux kernel CVE advisories from distribution maintainers and apply the corresponding errata.
Monitor for the presence of long-running packet capture processes on hosts that handle RxRPC traffic.
Alert on unexpected kernel module loads of rxrpc on systems that should not be running AFS workloads.

How to Mitigate CVE-2026-46000

Immediate Actions Required

Update the Linux kernel to a version containing the fix referenced by the upstream stable commits.
Identify systems running AFS or other RxRPC-dependent workloads and prioritize them for patching.
Restrict access to packet capture interfaces on hosts that process RxRPC traffic until the patched kernel is deployed.

Patch Information

The fix is committed across multiple stable branches. Refer to Kernel Git Commit 24481a7, Kernel Git Commit 98a2046, Kernel Git Commit c0428a2, Kernel Git Commit ca71ac2, and Kernel Git Commit d9b93a0. The change ensures cloned sk_buff instances are unshared before the security handler decrypts RESPONSE payload bytes.

Workarounds

Unload the rxrpc kernel module on systems that do not require AFS or RxRPC transport functionality.
Limit CAP_NET_RAW and CAP_NET_ADMIN capabilities to reduce the population of users able to open packet capture sockets.
Disable or remove tcpdump and similar tools on production hosts processing RxRPC traffic where capture is not operationally required.

bash

# Verify whether the rxrpc module is loaded and unload if not required
lsmod | grep rxrpc
sudo modprobe -r rxrpc

# Prevent automatic loading
echo 'blacklist rxrpc' | sudo tee /etc/modprobe.d/blacklist-rxrpc.conf

# Confirm running kernel version after patch deployment
uname -r