CVE-2026-46010: Linux Kernel Error Handling Vulnerability

CVE-2026-46010 Overview

CVE-2026-46010 is a Linux kernel vulnerability in the rxrpc subsystem, specifically within the rxgk_extract_token() function. The flaw stems from missing error handling when rxgk_decrypt_skb() returns -ENOMEM. Rather than propagating the memory allocation failure, the function continues execution and generates an abort condition reserved for other error types. The issue affects the RxGK authentication mechanism used by the Rx Remote Procedure Call (RPC) protocol in the kernel. The vulnerability has been resolved upstream through multiple stable branch commits.

Critical Impact
Improper error handling in the kernel rxrpc RxGK token extraction path can lead to incorrect abort generation when memory allocation fails, potentially affecting connection reliability and kernel state consistency.

Affected Products

Linux kernel versions containing the rxrpc RxGK token extraction code
Distributions shipping affected stable kernel branches prior to the fix
Systems relying on AFS/Rx RPC with RxGK authentication

Discovery Timeline

2026-05-27 - CVE-2026-46010 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46010

Vulnerability Analysis

The vulnerability resides in rxgk_extract_token(), a function in the Linux kernel rxrpc networking subsystem responsible for extracting authentication tokens used by the RxGK security class. During token extraction, the function calls rxgk_decrypt_skb() to decrypt the associated socket buffer (skb).

The original implementation did not distinguish between memory allocation failures and cryptographic or protocol errors. When rxgk_decrypt_skb() returned -ENOMEM, indicating insufficient memory, the code path continued and generated an RPC abort. Aborts are intended only for protocol-level failures, not for transient resource exhaustion.

This incorrect handling can produce inappropriate abort responses to peers, terminate sessions that should be retried, and leave the kernel in an inconsistent error reporting state. The fix returns the -ENOMEM error directly without generating an abort, while preserving abort behavior for other error classes.

Root Cause

The root cause is an input validation and error handling gap [CWE-755] in rxgk_extract_token(). The function failed to check the specific return value of rxgk_decrypt_skb() before deciding whether to generate an abort, conflating local resource errors with remote protocol violations.

Attack Vector

The NVD entry does not enumerate a remote attack vector or CVSS score. The defect is reachable through the RxGK authentication path, which processes tokens received over the network. Conditions triggering -ENOMEM would typically arise under memory pressure rather than direct attacker control, though resource exhaustion scenarios may amplify impact.

No public proof-of-concept code is referenced in the advisory. Refer to the upstream commits for the corrected logic: commit 293095e, commit 3476c8b, and commit c52803e.

Detection Methods for CVE-2026-46010

Indicators of Compromise

Unexpected RxRPC abort packets generated under memory pressure conditions on Linux hosts using RxGK authentication.
Kernel log entries showing rxrpc token decryption failures correlated with low-memory events (OOM, slab allocation failures).
Repeated RxGK session terminations from a single client or server without corresponding protocol-level errors.

Detection Strategies

Inventory kernel versions across Linux fleet and compare against the patched stable branches referenced in the kernel.org commits.
Monitor dmesg and journalctl for rxrpc subsystem warnings, especially around skb decryption and token processing.
Correlate memory pressure metrics with RxRPC connection terminations to identify hosts likely affected by the unpatched code path.

Monitoring Recommendations

Track kernel package versions through configuration management tooling and flag systems running pre-patch stable kernels.
Capture network telemetry for unexpected Rx abort frames originating from production hosts.
Enable kernel audit logging for the rxrpc module on systems running AFS or other RxGK-dependent workloads.

How to Mitigate CVE-2026-46010

Immediate Actions Required

Update Linux kernels to versions containing the fix from the referenced stable commits.
Identify all hosts using RxRPC with RxGK authentication, such as OpenAFS deployments, and prioritize them for patching.
Validate that distribution vendor advisories are applied through standard update channels (apt, dnf, zypper).

Patch Information

The fix has been merged into the mainline Linux kernel and backported to stable branches. Refer to the upstream commits: 293095ef6188, 3476c8bb960f, and c52803e92560. Apply the kernel update provided by your Linux distribution and reboot affected systems.

Workarounds

Disable RxGK-based authentication on systems where it is not required until patches can be applied.
Reduce memory pressure on affected hosts by tuning workloads and vm.overcommit settings to lower the likelihood of -ENOMEM returns in the rxrpc path.
Restrict network exposure of RxRPC services to trusted networks using host or perimeter firewalls.

bash

# Verify running kernel version and check for the rxrpc module
uname -r
lsmod | grep rxrpc

# Update kernel on Debian/Ubuntu
sudo apt update && sudo apt upgrade linux-image-$(uname -r)

# Update kernel on RHEL/Fedora
sudo dnf update kernel

# Reboot to load the patched kernel
sudo systemctl reboot