CVE-2026-64208 Overview
CVE-2026-64208 affects the Linux kernel's crypto/krb5 library and the AF_RXRPC networking subsystem. The vulnerability stems from missing pre-decrypt and pre-verify length checks on incoming messages. Attackers on the network can send malformed RxGK-secured DATA packets to trigger the flaw. The issue impacts availability, making it a denial-of-service risk against systems using RxRPC with Rx Generic Security (RxGK). The upstream fix modifies the krb5 crypto library to expose length precheck facilities and updates AF_RXRPC to validate DATA packets before decryption.
Critical Impact
Remote unauthenticated attackers can trigger a high-impact denial-of-service condition against Linux kernels using AF_RXRPC with RxGK authentication.
Affected Products
- Linux kernel crypto/krb5 library
- Linux kernel AF_RXRPC networking subsystem
- Systems using RxGK-secured RxRPC communication
Discovery Timeline
- 2026-07-24 - CVE-2026-64208 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64208
Vulnerability Analysis
The Linux kernel crypto/krb5 library historically decrypted or verified inbound messages without first validating their length against expected bounds. This omission propagated into AF_RXRPC, which relies on the krb5 library for RxGK-secured DATA packet processing. When a crafted RxRPC packet arrives, the kernel proceeds through cryptographic operations on data that may violate structural assumptions. The resulting condition affects availability of the kernel networking stack.
The patch introduces explicit precheck facilities in the krb5 crypto library. AF_RXRPC was then updated to invoke these checks against incoming RxGK DATA packets before any decryption or verification work occurs.
Root Cause
The root cause is improper input validation ahead of cryptographic operations. Neither crypto/krb5 nor its consumer AF_RXRPC enforced length constraints on messages passed to the decrypt and verify paths. Downstream code assumed correctly sized input, so malformed lengths reached routines that were not defensive against them.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted DATA packets to a Linux host running RxRPC with RxGK security. Because RxRPC underpins AFS and related distributed services, exposed endpoints processing untrusted peer traffic are reachable candidates.
No public proof-of-concept code is available. See the upstream commits 2b50aceafe66, 585f9f6aef5c, and 9217017f4bce for the exact code changes.
Detection Methods for CVE-2026-64208
Indicators of Compromise
- Unexpected kernel crashes or oops messages referencing rxrpc or krb5 symbols in dmesg and /var/log/kern.log.
- Sudden termination of RxRPC-dependent services such as AFS clients or servers following inbound traffic bursts.
- Repeated malformed RxRPC DATA packets targeting UDP ports used by AFS or other RxRPC consumers.
Detection Strategies
- Monitor kernel logs for panics, warnings, or BUG traces originating in net/rxrpc or crypto/krb5 code paths.
- Correlate network capture data with kernel events to identify anomalous RxGK-secured DATA packet patterns.
- Track running kernel versions across the fleet and flag hosts that have not received the upstream fix.
Monitoring Recommendations
- Enable persistent kernel log collection and forward kern.log to a central analytics platform for pattern detection.
- Alert on service restarts for AFS, kAFS, or other RxRPC-dependent daemons.
- Baseline normal RxRPC traffic volume and flag deviations that coincide with kernel warnings.
How to Mitigate CVE-2026-64208
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits 2b50aceafe66, 585f9f6aef5c, and 9217017f4bce.
- Update to a distribution kernel that incorporates the AF_RXRPC and crypto/krb5 length precheck fix.
- Inventory hosts running RxRPC or AFS services and prioritize them for patching.
Patch Information
The fix modifies the krb5 crypto library to provide length precheck helpers and updates AF_RXRPC to validate DATA packets secured with RxGK before decryption or verification. Patch commits are available in the Linux stable tree at kernel.org commit 2b50aceafe66, kernel.org commit 585f9f6aef5c, and kernel.org commit 9217017f4bce.
Workarounds
- Restrict inbound RxRPC traffic at network boundaries to trusted peers only.
- Disable or unload the rxrpc kernel module on systems that do not require AFS or RxRPC connectivity.
- Segment AFS infrastructure so that RxRPC endpoints are not exposed to untrusted networks.
# Confirm kernel version and check for rxrpc module usage
uname -r
lsmod | grep rxrpc
# Temporarily unload rxrpc where not required
sudo modprobe -r rxrpc
# Prevent automatic loading until patched
echo "blacklist rxrpc" | sudo tee /etc/modprobe.d/blacklist-rxrpc.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
