PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45988 Linux CVE debrief

A logic error in the Linux kernel's RxRPC (Remote Procedure Call over RX) subsystem could allow partially decrypted RESPONSE packets to be requeued for retry, potentially leading to cryptographic state corruption. The vulnerability occurs when temporary processing failures leave packets in an inconsistent decryption state. The fix discards affected packets rather than requeuing them, relying on protocol retransmission (CHALLENGE/RESPONSE exchange) to recover. No CVSS score has been assigned; the issue is currently Awaiting Analysis per NVD.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux system administrators running kernels with RxRPC support enabled; security teams tracking kernel networking subsystem vulnerabilities; organizations using AFS (Andrew File System) or other RxRPC-dependent services

Technical summary

The RxRPC subsystem in the Linux kernel mishandles RESPONSE packets that encounter temporary processing failures. When decryption is interrupted, packets may be left in a partially decrypted state and subsequently requeued for retry, creating potential for cryptographic state inconsistency. The resolution discards such packets entirely, allowing the CHALLENGE/RESPONSE protocol mechanism to generate fresh packets rather than attempting to recover corrupted state. A parallel fix applies to CHALLENGE packet handling when RESPONSE generation fails.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from stable branches when available
  • Monitor NVD for CVSS scoring and CISA KEV listing
  • Review systems using RxRPC for kernel version exposure
  • Validate kernel patch application through standard distribution channels

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Patch commits identified in kernel.org stable tree. Vendor attribution marked low-confidence based on reference domain candidate 'Kernel'; requires review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45988 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45988

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45988 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45988

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0422e7a4883f25101903f3e8105c0808aa5f4ce9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/76cb9a2d252274adfae6e293a292434631a7d472

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7b89868305052b94a91b708c462bc2281fa42a4a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d61482be4aae1835b78875761206241835a7510e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f55b383070170e988e4dec28be2af1714d258521

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.