CVE-2026-46012: Linux Kernel Memory Leak Vulnerability

CVE-2026-46012 Overview

CVE-2026-46012 is a memory leak vulnerability in the Linux kernel's rxrpc subsystem, specifically within the rxkad_verify_response() function used by the Rxkad authentication mechanism. The function failed to consistently free allocated resources, including the ticket buffer and the server key, across all error and success paths. Repeated invocation of the vulnerable code path can exhaust kernel memory over time.

The fix restructures the function to initialize the ticket pointer to NULL and route all execution paths through a single common epilogue that releases all allocated resources, with the release routines safely skipping NULL pointers.

Critical Impact
Repeated triggering of rxkad_verify_response() can leak ticket buffers and server key references, leading to kernel memory exhaustion and potential denial of service on systems using Rxkad/AFS networking.

Affected Products

Linux kernel (mainline) — rxrpc subsystem, rxkad_verify_response() in net/rxrpc/rxkad.c
Stable kernel branches receiving the backported fixes referenced in the upstream commits
Distributions packaging vulnerable kernel versions with the rxrpc module enabled

Discovery Timeline

2026-05-27 - CVE-2026-46012 published to the National Vulnerability Database (NVD)
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46012

Vulnerability Analysis

The rxrpc subsystem implements the AF_RXRPC socket family used primarily by Andrew File System (AFS) clients. Rxkad is the Kerberos-derived authentication scheme used to verify client and server tokens within rxrpc calls. The function rxkad_verify_response() validates a server response containing an encrypted ticket and associated server key material.

The defect is a [CWE-401] missing release of memory after effective lifetime. Multiple control-flow paths through rxkad_verify_response() returned without freeing the dynamically allocated ticket buffer or releasing the reference taken on the server key. Each failed verification could leak both allocations.

Although no remote code execution is possible, repeated triggering of the vulnerable path exhausts non-swappable kernel memory. On long-running systems exposed to untrusted rxrpc peers, the leak degrades availability.

Root Cause

The root cause is inconsistent error handling. The original implementation contained multiple return statements after allocations were performed, each requiring its own cleanup. Cleanup was incomplete on several branches. The corrective patch initializes the ticket pointer to NULL at function entry and consolidates cleanup into a single epilogue. The release routines tolerate NULL inputs, so the epilogue is safe regardless of where the function exits.

Attack Vector

An attacker capable of initiating Rxkad-authenticated rxrpc connections to a vulnerable host can repeatedly send malformed or rejected response packets. Each rejected response leaks the associated ticket and server key reference. The attack requires network reachability to a host running an rxrpc listener, such as an AFS file server or client with active calls.

The vulnerability is described in the upstream commits. See the Linux kernel stable commit 34f61a07e0cd and related backports for the patch details.

Detection Methods for CVE-2026-46012

Indicators of Compromise

Steady growth in kernel slab allocations attributable to rxrpc or kmalloc ticket buffers observed via /proc/slabinfo
Increasing kernel memory consumption without corresponding userspace allocation growth on hosts running AFS or rxrpc workloads
Repeated authentication failures logged by rxrpc or AFS clients from a single remote peer

Detection Strategies

Monitor kernel memory utilization trends with vmstat, slabtop, and meminfo on systems that load the rxrpc module
Compare installed kernel package versions against the fixed commits referenced in the NVD entry to identify unpatched hosts
Inspect dmesg and journalctl -k output for rxrpc authentication errors correlating with memory growth

Monitoring Recommendations

Establish baselines for kernel slab consumption on AFS file servers and clients, alerting on sustained upward drift
Track network sources generating high volumes of failed Rxkad authentications and correlate with kernel memory pressure events
Include kernel package versioning in configuration management reporting to confirm patch deployment across the fleet

How to Mitigate CVE-2026-46012

Immediate Actions Required

Apply the upstream kernel patches identified by commits 34f61a07e0cd, 852b9d64cea4, 861b9a0a1823, c4b8f32e73ea, and c91f33fb8356 via your distribution's kernel update channel
Reboot affected hosts after kernel package installation to load the patched kernel image
Restrict inbound rxrpc traffic to trusted AFS cells and authenticated peers until patches are deployed

Patch Information

The Linux kernel maintainers resolved the issue across multiple stable branches. The fix changes rxkad_verify_response() to initialize the ticket pointer to NULL and route all paths through a single cleanup epilogue. Patched commits are available at the Linux stable tree: commit 852b9d64cea4, commit 861b9a0a1823, commit c4b8f32e73ea, and commit c91f33fb8356.

Workarounds

Unload the rxrpc kernel module on hosts that do not require AFS or Rxkad-authenticated networking using modprobe -r rxrpc
Use host firewall rules to block inbound traffic to UDP port 7001 and other Rxkad-related ports from untrusted networks
Schedule periodic reboots on unpatched, exposed systems to reclaim leaked kernel memory until the patch is applied

bash

# Verify the running kernel version and rxrpc module status
uname -r
lsmod | grep rxrpc

# Unload rxrpc if AFS/Rxkad is not required on this host
sudo modprobe -r rxrpc

# Prevent automatic loading via modprobe blacklist
echo 'blacklist rxrpc' | sudo tee /etc/modprobe.d/blacklist-rxrpc.conf