PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45998 Linux CVE debrief

A use-after-free (UAF) vulnerability exists in the Linux kernel's RxRPC networking subsystem. The flaw occurs in rxrpc_input_packet() when skb_unshare() fails to unshare a packet due to memory allocation failure. In this failure path, the skb pointer in the parent function (rxrpc_io_thread()) is set to NULL, but subsequent code may still attempt to access this freed/NULLed pointer through trace_rxrpc_rx_done(), leading to a kernel oops or potential memory corruption. The vulnerability is triggered during RxRPC packet processing when the system is under memory pressure. The fix relocates the skb_unshare() call to a later point in the processing path where DATA packets are handled, avoiding unnecessary unsharing for packets that will be discarded anyway, and simplifies the function signature to use a direct pointer rather than a pointer-to-pointer.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-08-17
Advisory published
2026-05-27
Advisory updated
2026-08-17

Who should care

Organizations running Linux systems with RxRPC-enabled workloads, particularly those using AFS (Andrew File System), Kerberos, or other RxRPC-based protocols. Systems under memory pressure are at elevated risk.

Technical summary

The RxRPC (Remote Procedure Call over Rx) kernel subsystem contains a use-after-free vulnerability in its packet input handling. When skb_unshare() fails due to memory allocation exhaustion, the socket buffer pointer is NULLed in the caller's scope, but the tracepoint trace_rxrpc_rx_done() may still dereference this invalid pointer. The fix moves skb_unshare() to rxrpc_input_call_packet() where it's only invoked for DATA packets that will actually be processed, eliminating the failure path from rxrpc_input_packet() and allowing simplification of its interface from pointer-to-pointer to direct pointer.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from stable branches once patches are available for your distribution
  • Monitor for kernel package updates addressing CVE-2026-45998
  • Consider enabling kernel memory pressure monitoring if RxRPC is heavily utilized
  • Review RxRPC usage in environment (AFS, Kerberos, or other userspace RxRPC consumers)
  • Prioritize patching on systems with constrained memory where allocation failures are more likely

Evidence notes

Vulnerability description confirms UAF pattern in skb_unshare() failure path. Multiple stable kernel commits provided indicate backports to supported branches. No CVSS score assigned yet (status: Awaiting Analysis). No KEV listing.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45998 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45998

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45998 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45998

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1f2740150f904bfa60e4bad74d65add3ccb5e7f8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8fde6296c4d4da2be7ab761305ab7f232b94eefd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/996b0487b3cdda4c91811dbb1c9564626bc840bd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bf20f46d94f1db38e6ffc0ca204a5fe0de01b495

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e3bf143b1e98fb3d6d9e6825bcd683974d478e8c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.