CVE-2026-46000 Linux CVE debrief

Who should care

Organizations running Linux systems with rxrpc-enabled services (AFS file servers, Kerberos deployments), security teams monitoring network traffic on affected systems, kernel maintainers and distribution packagers responsible for stable kernel updates

Technical summary

The rxrpc kernel subsystem handles Remote Procedure Call over Rx protocol, used by services like AFS (Andrew File System) and Kerberos. RESPONSE packets in this protocol undergo security verification that includes in-place decryption of packet contents. The sk_buff (socket buffer) structure used for network packets can be cloned/shared across multiple consumers, including packet sniffers. When security operations decrypted RESPONSE packets in-place on a shared sk_buff, any attached packet sniffer would receive the modified (decrypted) data instead of the original ciphertext. This could expose decrypted protocol contents to unauthorized observers or cause diagnostic confusion. The resolution detects cloned packets and passes a copy to security handlers, preserving the original buffer state for other consumers.

Defensive priority

medium

Recommended defensive actions

• Apply kernel updates containing the referenced stable commits when available for your distribution
• Monitor Linux distribution security advisories for backported fixes to affected kernel versions
• Review network monitoring configurations for systems using rxrpc (AFS, Kerberos) to ensure no sensitive data exposure occurred
• Consider restricting packet capture capabilities to authorized processes as defense in depth

Evidence notes

The vulnerability description indicates this is a resolved issue in the Linux kernel rxrpc subsystem. The fix involves modifying conn-level packet handling to unshare RESPONSE packets before security operations perform in-place decryption. Multiple stable kernel commits are referenced, suggesting backports to various kernel versions. The issue was published to CVE.org and NVD on 2026-05-27 with status 'Awaiting Analysis'. No CVSS score or severity has been assigned at time of disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.