PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46039 Linux CVE debrief

A vulnerability in the Linux kernel's rxgk (RXGK - RX GSSAPI Kerberos) component has been resolved. The issue was a potential integer overflow in the `rxgk_extract_token()` function during a length check for ticket validation. The fix changes the comparison logic: instead of rounding up the value being tested (which could overflow), the patch rounds down the size of available data for comparison. This is a defensive coding fix in the kernel's Kerberos authentication handling for AFS (Andrew File System) RXGK security class.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Organizations running Linux kernels with AFS (Andrew File System) support and RXGK Kerberos authentication enabled; kernel maintainers and security teams tracking memory safety issues in network authentication code.

Technical summary

The vulnerability existed in `rxgk_extract_token()` where a length check for ticket data could potentially overflow when rounding up the comparison value. The fix inverts the logic to round down the available data size instead, eliminating the overflow condition. This affects the RXGK Kerberos 5 security class implementation used in AFS (Andrew File System) communications.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version and confirm if rxgk/AFS RXGK security class is in use
  • Apply stable kernel updates containing the referenced commits when available
  • Monitor NVD for CVSS scoring once analysis is complete
  • Assess exposure if Kerberos-authenticated AFS services are deployed

Evidence notes

The CVE description indicates this is a resolved kernel vulnerability with patches available. Three stable kernel commits are referenced, suggesting backports to multiple kernel versions. The vendor is identified as the Linux kernel project based on the git.kernel.org source references. No CVSS score or severity has been assigned yet (status: Awaiting Analysis). No KEV listing or known ransomware campaign use is indicated.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46039 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46039

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46039 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46039

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/183d37f12d1c8ed24a5bfc7addad05510da22a94

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/43222ac484f93b3ec2d240a7575e1cedd31f5fa4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6929350080f4da292d111a3b33e53138fee51cec

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.