CVE-2026-64026: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64026 Overview

CVE-2026-64026 is a Linux kernel vulnerability in the rxrpc subsystem that improves the earlier fix for CVE-2026-43500. The flaw allows pagecache corruption caused by in-place decryption of a DATA packet transmitted locally by splice(). When the I/O thread shared packet buffers, decrypting a DATA packet in place could corrupt pagecache data belonging to unrelated files. The kernel fix removes packet sharing in the I/O thread and unconditionally extracts packet content into a per-call bounce buffer for decryption before recvmsg() copies it to userspace.

Critical Impact
Local users with the ability to trigger splice() operations against rxrpc sockets can corrupt pagecache contents, resulting in high impact to confidentiality, integrity, and availability on affected Linux systems.

Affected Products

Linux kernel rxrpc subsystem (AF_RXRPC socket family)
Linux distributions shipping vulnerable stable kernel branches referenced by the upstream fix commits
Systems using AFS or Kerberos-based RxRPC services with local splice() transmission

Discovery Timeline

2026-07-19 - CVE-2026-64026 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64026

Vulnerability Analysis

The vulnerability resides in the AF_RXRPC transport implementation in the Linux kernel. RxRPC supports zero-copy transmit via splice(), which allows a userspace application to send pagecache-backed pages directly through a socket without copying them into a kernel buffer. On the receive side, the rxrpc I/O thread previously performed in-place decryption on the sk_buff data pages received by the peer end. When the transmit and receive endpoints were both local, the decryption operation wrote back into pagecache pages still mapped by the filesystem layer.

The result was silent corruption of file contents in the pagecache. The corruption is a functional integrity failure and also a security concern because a local attacker can direct decrypted output into pages backing arbitrary files that the RxRPC pipeline touches. The upstream fix commits (46cb765e, a05bf6d9, b94a6ccb, c5800877, and d2bc90cf) rework recvmsg() to extract packet content into a bounce buffer owned by the call.

Root Cause

The root cause is in-place decryption performed on shared sk_buff pages that may still be referenced by the pagecache after a local splice() transmit. The I/O thread had no mechanism to detect that the underlying pages were shared with the filesystem layer, so cryptographic writes to those pages corrupted user file data. Additionally, rx_pkt_offset used 0 as a sentinel value, complicating handling of the newly introduced bounce buffer and requiring the switch to USHRT_MAX as the invalid-offset indicator.

Attack Vector

Exploitation requires local access and the ability to send and receive rxrpc traffic through the same host. An attacker sets up an AF_RXRPC endpoint, uses splice() from a pagecache-backed file descriptor to transmit DATA packets to a locally reachable service, and then triggers recvmsg() on the peer socket. The pre-patch I/O thread decrypts the DATA payload in place on pages still owned by the pagecache, mutating file contents shared with unrelated processes. The MSG_PEEK handling introduced by the fix also required correction so that a later peeked packet does not leave stale decrypted content behind for a subsequent recvmsg().

No public proof-of-concept code has been released. The upstream commit messages and the referenced kernel git commits provide the authoritative technical detail on the reproduction path.

Detection Methods for CVE-2026-64026

Indicators of Compromise

Unexpected corruption of files served through AFS or other RxRPC-backed services on hosts running vulnerable kernels
Kernel version strings matching pre-patch stable branches that lack the referenced fix commits
Local processes creating AF_RXRPC sockets combined with splice() calls from file-backed descriptors

Detection Strategies

Inventory running kernel versions across the fleet and cross-reference against the fix commits 46cb765e, a05bf6d9, b94a6ccb, c5800877, and d2bc90cf in the stable trees
Audit systems for use of AF_RXRPC (socket(AF_RXRPC, ...)) and correlate with splice() syscall telemetry to identify exposure
Monitor filesystem integrity for AFS-backed content and pagecache consistency checks in kernel logs

Monitoring Recommendations

Enable audit rules on the socket and splice syscalls for processes not on an approved allowlist
Track kernel package updates in configuration management to confirm patched builds are deployed
Alert on unexpected loading of the rxrpc kernel module on hosts that do not use AFS

How to Mitigate CVE-2026-64026

Immediate Actions Required

Apply vendor kernel updates that incorporate the upstream rxrpc fix commits referenced in the NVD advisory
Restrict local access on multi-tenant systems until a patched kernel is deployed
Unload the rxrpc module on hosts that do not require AFS or Kerberos RxRPC services

Patch Information

The fix is implemented across the upstream stable commits Kernel Git Commit 46cb765e, Kernel Git Commit a05bf6d9, Kernel Git Commit b94a6ccb, Kernel Git Commit c5800877, and Kernel Git Commit d2bc90cf. The patches allocate a per-call bounce buffer (initially 2K, sufficient for a jumbo subpacket, and grown as needed), decrypt into that buffer, and copy to userspace during recvmsg(), leaving the sk_buff unmodified. The invalid offset sentinel is switched from 0 to USHRT_MAX.

Workarounds

Blacklist the rxrpc kernel module (echo 'blacklist rxrpc' > /etc/modprobe.d/rxrpc.conf) on hosts that do not use AFS
Enforce least-privilege access to prevent untrusted local users from opening AF_RXRPC sockets
Disable AFS client and server services until the patched kernel is deployed

bash

# Prevent the vulnerable rxrpc module from loading until a patched kernel is installed
echo 'install rxrpc /bin/true' | sudo tee /etc/modprobe.d/disable-rxrpc.conf
sudo rmmod rxrpc 2>/dev/null || true
uname -r   # Confirm running kernel version, then verify against distro advisory