CVE-2026-46000: rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
The security operations that verify the RESPONSE packets decrypt bits of it in place - however, the skbuff may be shared with a packet sniffer, which would lead to the sniffer seeing an apparently corrupt packet (actually decrypted).
Fix this by handing a copy of the packet off to the specific security handler if the packet was cloned.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
Exploitation is rated local with low attack complexity and requires low privileges. No user interaction is required.
What is the expected security impact?
The reported impact is limited to availability, rated high. Confidentiality and integrity impacts are rated none.
How would this issue present to systems or tools observing RxRPC traffic?
A shared RESPONSE packet can be modified in place during security processing, causing a packet sniffer sharing that packet buffer to see what appears to be a corrupt packet. The fix provides a copy to the security handler when the packet was cloned.
Which software versions are identified in the available data?
The affected software listing identifies Linux kernel generally and Microsoft azl3 kernel version 6.6.139.1-1. No other specific Linux kernel versions are provided.