PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45988 Linux CVE debrief

A logic error in the Linux kernel's RxRPC (Remote Procedure Call over RX) subsystem could allow partially decrypted RESPONSE packets to be requeued for retry, potentially leading to cryptographic state corruption. The vulnerability occurs when temporary processing failures leave packets in an inconsistent decryption state. The fix discards affected packets rather than requeuing them, relying on protocol retransmission (CHALLENGE/RESPONSE exchange) to recover. No CVSS score has been assigned; the issue is currently Awaiting Analysis per NVD.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running kernels with RxRPC support enabled; security teams tracking kernel networking subsystem vulnerabilities; organizations using AFS (Andrew File System) or other RxRPC-dependent services

Technical summary

The RxRPC subsystem in the Linux kernel mishandles RESPONSE packets that encounter temporary processing failures. When decryption is interrupted, packets may be left in a partially decrypted state and subsequently requeued for retry, creating potential for cryptographic state inconsistency. The resolution discards such packets entirely, allowing the CHALLENGE/RESPONSE protocol mechanism to generate fresh packets rather than attempting to recover corrupted state. A parallel fix applies to CHALLENGE packet handling when RESPONSE generation fails.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from stable branches when available
  • Monitor NVD for CVSS scoring and CISA KEV listing
  • Review systems using RxRPC for kernel version exposure
  • Validate kernel patch application through standard distribution channels

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Patch commits identified in kernel.org stable tree. Vendor attribution marked low-confidence based on reference domain candidate 'Kernel'; requires review.

Official resources

2026-05-27