CVE-2026-46000

Analyzed Analyzed - Analysis Complete

rxrpc: Fix Shared Packet Handling Leading to Information Exposure

Publication date: 2026-05-27

Last updated on: 2026-06-16

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix conn-level packet handling to unshare RESPONSE packets The security operations that verify the RESPONSE packets decrypt bits of it in place - however, the sk_buff may be shared with a packet sniffer, which would lead to the sniffer seeing an apparently corrupt packet (actually decrypted). Fix this by handing a copy of the packet off to the specific security handler if the packet was cloned.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-16

Generated

2026-07-06

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-05

NVD

CVE-2026-46000

EUVD

EUVD-2026-32296

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.7 (inc) to 6.12.88 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.27 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.4 (exc)
linux	linux_kernel	From 2.6.22 (inc) to 6.6.140 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by fixing the conn-level packet handling to unshare RESPONSE packets. To mitigate this vulnerability, you should update your Linux kernel to the latest version that includes this fix.

Executive Summary

This vulnerability exists in the Linux kernel's rxrpc component related to how RESPONSE packets are handled at the connection level.

The security operations decrypt parts of RESPONSE packets in place, but the underlying packet buffer (sk_buff) may be shared with a packet sniffer.

Because of this sharing, the sniffer could see a decrypted packet that appears corrupt, potentially exposing sensitive decrypted data.

The fix involves making a copy of the packet for the security handler if the packet was cloned, preventing the sniffer from seeing the decrypted data.

Impact Analysis

An attacker or unauthorized user running a packet sniffer on the affected system could observe decrypted parts of RESPONSE packets that should remain confidential.

This could lead to exposure of sensitive information that is normally protected by encryption, potentially compromising system security or privacy.

Hi! I’m here to help you understand CVE-2026-46000. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70