CVE-2026-46010: rxrpc: Fix error handling in rxgk_extract_token()

Q: What condition is required to trigger the affected error path?

The issue occurs when rxgk_extract_token() calls rxgk_decrypt_skb() and that operation returns -ENOMEM, indicating an out-of-memory condition during token decryption.

Q: What is the expected behavior after the fix?

When rxgk_decrypt_skb() returns -ENOMEM, rxgk_extract_token() returns that error directly. Other decryption errors continue to generate an abort.

Q: Is an attacker required to authenticate or interact with a user?

The supplied vector lists no privileges required and no user interaction required. It also lists network attack vector, although the description specifically identifies the vulnerable condition as an -ENOMEM return during token decryption.

Published May 27, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix error handling in rxgkextracttoken()

Fix a missing bit of error handling in rxgkextracttoken(): in the event that rxgkdecryptskb() returns -ENOMEM, it should just return that rather than continuing on (for anything else, it generates an abort).

Affected Software

6 affected components

Linux Linux kernel

Linux Linux kernel>=6.16.9<6.17

Linux Linux kernel>=6.17.1<6.18.27

Linux Linux kernel>=6.19<7.0.4

Linux Linux kernel=6.17

Linux Linux kernel=6.17-rc7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
In rxgk_extract_token(), ensure that when rxgk_decrypt_skb() returns -ENOMEM, you propagate that return value directly (return -ENOMEM) rather than continuing on for other error handling that leads to an abort.
Linux kernel rxrpc (rxgk_extract_token / rxgk_decrypt_skb) error handling return path = return -ENOMEM directly from rxgk_decrypt_skb() when it returns -ENOMEM (instead of continuing on into abort)

Event History

May 27, 2026

CVE Published

via MITRE·12:56 PM

Data Sourced

via MITRE·12:56 PM

DescriptionSeverity

Data Sourced

via NVD·02:17 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What condition is required to trigger the affected error path?

The issue occurs when rxgk_extract_token() calls rxgk_decrypt_skb() and that operation returns -ENOMEM, indicating an out-of-memory condition during token decryption.

What is the expected behavior after the fix?

When rxgk_decrypt_skb() returns -ENOMEM, rxgk_extract_token() returns that error directly. Other decryption errors continue to generate an abort.

Is an attacker required to authenticate or interact with a user?

The supplied vector lists no privileges required and no user interaction required. It also lists network attack vector, although the description specifically identifies the vulnerable condition as an -ENOMEM return during token decryption.

CVE-2026-46010: rxrpc: Fix error handling in rxgk_extract_token()

Affected Software

Remediation

Event History

Frequently Asked Questions

What condition is required to trigger the affected error path?

What is the expected behavior after the fix?

Is an attacker required to authenticate or interact with a user?

Company

Resources

Contact

Frequently Asked Questions

What condition is required to trigger the affected error path?

What is the expected behavior after the fix?

Is an attacker required to authenticate or interact with a user?