PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46039 Linux CVE debrief

A vulnerability in the Linux kernel's rxgk (RXGK - RX GSSAPI Kerberos) component has been resolved. The issue was a potential integer overflow in the `rxgk_extract_token()` function during a length check for ticket validation. The fix changes the comparison logic: instead of rounding up the value being tested (which could overflow), the patch rounds down the size of available data for comparison. This is a defensive coding fix in the kernel's Kerberos authentication handling for AFS (Andrew File System) RXGK security class.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux kernels with AFS (Andrew File System) support and RXGK Kerberos authentication enabled; kernel maintainers and security teams tracking memory safety issues in network authentication code.

Technical summary

The vulnerability existed in `rxgk_extract_token()` where a length check for ticket data could potentially overflow when rounding up the comparison value. The fix inverts the logic to round down the available data size instead, eliminating the overflow condition. This affects the RXGK Kerberos 5 security class implementation used in AFS (Andrew File System) communications.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version and confirm if rxgk/AFS RXGK security class is in use
  • Apply stable kernel updates containing the referenced commits when available
  • Monitor NVD for CVSS scoring once analysis is complete
  • Assess exposure if Kerberos-authenticated AFS services are deployed

Evidence notes

The CVE description indicates this is a resolved kernel vulnerability with patches available. Three stable kernel commits are referenced, suggesting backports to multiple kernel versions. The vendor is identified as the Linux kernel project based on the git.kernel.org source references. No CVSS score or severity has been assigned yet (status: Awaiting Analysis). No KEV listing or known ransomware campaign use is indicated.

Official resources

2026-05-27