CVE-2026-46085 Overview
CVE-2026-46085 affects the Linux kernel's rxrpc networking subsystem, specifically the rxkad Kerberos-based security class used by AFS (Andrew File System) clients. The flaw stems from improper handling of packets carrying a misaligned cryptographic payload length. Decryption errors other than -ENOMEM were not handled correctly, and a WARN_ON_ONCE() call could be triggered remotely by crafted network traffic. Kernel maintainers resolved the issue by aborting on non-memory decryption errors and removing the remotely reachable warning while preserving trace output.
Critical Impact
A remote attacker on the network path can send malformed rxrpc packets to trigger kernel warnings and disrupt decryption handling on affected Linux systems.
Affected Products
- Linux kernel rxrpc subsystem (upstream)
- Linux kernel stable branches receiving the referenced backport commits
- Distributions shipping kernels with CONFIG_RXKAD or CONFIG_AF_RXRPC enabled
Discovery Timeline
- 2026-05-27 - CVE-2026-46085 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46085
Vulnerability Analysis
The vulnerability resides in the rxkad security class of the Linux kernel's rxrpc implementation, which provides authenticated and encrypted transport for AFS RPC traffic. When an inbound packet arrives with a crypto length that is not properly aligned to the cipher block boundary, the kernel previously did not handle the condition gracefully. Additionally, the decryption path treated only -ENOMEM as a recoverable error and ignored other failure return codes from the crypto API. A WARN_ON_ONCE() macro in the affected path could be reached by a remote peer sending a crafted packet, polluting kernel logs and potentially impacting availability through repeated warning generation on systems configured with panic_on_warn.
Root Cause
The root cause is missing input validation on the crypto length field of incoming rxrpc packets combined with incomplete error handling around the skcipher decryption call. The patch series fixes alignment validation, aborts the call on any non-ENOMEM decryption error, and removes the remotely reachable warning. A trace line is retained for diagnostic visibility.
Attack Vector
An unauthenticated remote attacker with the ability to send rxrpc traffic to a vulnerable host can transmit a packet containing a misaligned crypto length. On vulnerable kernels this triggers the WARN_ON_ONCE() and unhandled decryption errors. Hosts running AFS clients or servers that listen on rxrpc are reachable on the network. Refer to the Linux kernel commit for the upstream fix details.
Detection Methods for CVE-2026-46085
Indicators of Compromise
- Kernel log entries containing WARN_ON_ONCE traces originating from net/rxrpc/rxkad.c on unpatched kernels
- Unexpected rxrpc call aborts associated with decryption failures in dmesg or journalctl output
- Anomalous inbound UDP traffic to rxrpc listeners (default port 7000/udp for AFS) from untrusted sources
Detection Strategies
- Inventory Linux hosts and identify kernels that lack the commits referenced in the stable tree.
- Monitor kernel ring buffer output for repeated warnings or aborts emitted from the rxkad code path.
- Inspect network telemetry for inbound rxrpc packets from unexpected sources, particularly toward AFS file servers and clients.
Monitoring Recommendations
- Forward kern.log and audit events to a centralized logging or SIEM platform for correlation across hosts.
- Alert on hosts where panic_on_warn is enabled and rxrpc-originated warnings appear, as these can lead to forced reboots.
- Track package and kernel inventory to confirm rollout of the patched build to all AFS-connected systems.
How to Mitigate CVE-2026-46085
Immediate Actions Required
- Apply the patched kernel from your distribution vendor or the upstream stable tree as soon as it is available.
- Restrict inbound rxrpc traffic to trusted AFS peers using host-based or network firewalls.
- Disable the rxkad module or kafs client on systems that do not require AFS connectivity.
Patch Information
The fix is published across multiple stable branches. Reference the upstream commits: 440d20d9, af9271eb, def304aa, f0d3efd0, and f1c6bd0c. Rebuild and reboot affected kernels after applying.
Workarounds
- Block UDP port 7000 at the perimeter for hosts that do not legitimately serve or consume AFS traffic.
- Unload the rxrpc and kafs kernel modules where AFS is not used: modprobe -r kafs rxrpc.
- Disable panic_on_warn on production hosts to prevent forced reboots triggered by remotely reachable warnings until the patch is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
