PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46085 Linux CVE debrief

A vulnerability in the Linux kernel's rxrpc subsystem has been resolved. The issue involved improper handling of packets with misaligned crypto lengths in the rxkad authentication mechanism. The fix addresses three specific problems: (1) correct handling of packets where the crypto length is not properly aligned, (2) proper abort handling for non-ENOMEM errors from decryption operations rather than continuing with potentially corrupted data, and (3) removal of a WARN_ON_ONCE() that could be remotely triggered by malicious actors (trace logging remains available for debugging). The vulnerability affects the kernel's RxRPC remote procedure call implementation used for AFS (Andrew File System) and other network filesystems. Multiple stable kernel branches received backported fixes.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Organizations running Linux systems with AFS (Andrew File System) clients or servers, kernel developers maintaining RxRPC implementations, and security teams monitoring network filesystem infrastructure.

Technical summary

The vulnerability exists in the Linux kernel's RxRPC (Remote Procedure Call over RX) subsystem, specifically in the rxkad authentication module. The rxkad mechanism provides Kerberos 4-style authentication for RxRPC connections, commonly used by AFS clients and servers. The flaw involved improper handling of cryptographic data with misaligned lengths, which could lead to undefined behavior or potential information disclosure. Additionally, non-ENOMEM decryption errors were not properly handled, potentially allowing processing to continue with invalid data. The WARN_ON_ONCE() macro was also removable as an attack vector since it could be triggered remotely to flood kernel logs or potentially destabilize systems. The fix ensures proper alignment checks, aborts connections on decryption failures, and replaces the WARN_ON_ONCE() with trace-based logging.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution when available, prioritizing systems running AFS or other RxRPC-dependent services
  • Monitor vendor security advisories for backported fixes to currently deployed kernel versions
  • Review kernel logs for rxrpc-related errors as indicators of potential exploitation attempts
  • Consider network segmentation for AFS and RxRPC services until patches are deployed

Evidence notes

CVE published 2026-05-27. Description confirms kernel-level fix for rxrpc rxkad crypto handling. Five kernel.org stable branch commits provided as references. No CVSS score or severity assigned by NVD at time of disclosure (status: Awaiting Analysis).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46085 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46085

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46085 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46085

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/440d20d95e844b657a93a0b2dcc2aae155efdce6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/af9271eb666d07b6f65612dc160a47f7cb5220ed

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/def304aae2edf321d2671fd6ca766a93c21f877e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f0d3efd03b2a9e0f1ffa6df8fcb264af3d494286

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f1c6bd0cc786a8fa74829ce3c4b3673944a308f4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.