PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46012 Linux CVE debrief

A memory leak vulnerability in the Linux kernel's RxRPC (Remote Procedure Call over Rx) subsystem has been resolved. The flaw existed in the `rxkad_verify_response()` function within the rxkad security module, which failed to properly free allocated memory for Kerberos tickets and server keys under certain error conditions. The fix ensures consistent cleanup by initializing the ticket pointer to NULL and routing all exit paths through a common epilogue that safely releases resources. This vulnerability could lead to memory exhaustion in systems utilizing RxRPC with Kerberos authentication, potentially affecting availability of network file system services such as AFS (Andrew File System).

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

System administrators operating Linux servers with RxRPC-enabled services (particularly AFS cell servers), kernel maintainers, and security teams monitoring memory exhaustion risks in network authentication subsystems

Technical summary

The vulnerability resides in `net/rxrpc/rxkad.c` in the Linux kernel's RxRPC implementation. The `rxkad_verify_response()` function, which handles Kerberos authentication ticket verification, contained multiple error paths that failed to release allocated memory for tickets and server keys. The fix adopts a centralized cleanup pattern: the ticket pointer is initialized to NULL, and all function exit paths converge on a single epilogue that conditionally frees resources (skipping NULL pointers). This defensive refactoring eliminates the leak vectors while improving code maintainability. The presence of five distinct stable branch commits suggests the fix has been or will be backported to multiple long-term support kernel versions.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable branch commits when available from your Linux distribution
  • Monitor memory utilization on systems running RxRPC services with Kerberos authentication
  • Review kernel changelogs for backport status to currently deployed kernel versions
  • Consider temporary mitigation by monitoring for abnormal memory growth in rxrpc kernel threads if patching is delayed

Evidence notes

The vulnerability description indicates memory leaks in `rxkad_verify_response()` where ticket and server key allocations were not freed under all circumstances. The resolution implements a defensive coding pattern: NULL initialization of the ticket pointer and a unified cleanup epilogue with NULL-safe releases. Multiple stable kernel branch commits are referenced, indicating backports across supported kernel versions.

Official resources

2026-05-27