CVE-2026-45988 Details
Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet gets a temporary failure during processing, it may end up in a partially decrypted state - and then get requeued for a retry. Fix this by just discarding the packet; we will send another CHALLENGE packet and thereby elicit a further response. Similarly, discard an incoming CHALLENGE packet if we get an error whilst generating a RESPONSE; the server will send another CHALLENGE.
A vulnerability in the Linux kernel's RxRPC implementation could lead to improper handling of RESPONSE packets. When a RESPONSE packet encounters a temporary processing failure, it may become partially decrypted and is then requeued for a retry. This issue has been addressed by modifying the handling of such packets: instead of requeuing them, the kernel now discards the problematic RESPONSE packet and sends a new CHALLENGE packet to prompt a fresh response from the server. This change ensures that RESPONSE packets are properly processed without leaving them in a vulnerable state. The vulnerability affects the Linux kernel stable tree.
Users can update to the latest version of the Linux kernel stable tree, where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux Kernel Archive.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0422e7a4883f25101903f3e8105c0808aa5f4ce9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/76cb9a2d252274adfae6e293a292434631a7d472 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7b89868305052b94a91b708c462bc2281fa42a4a | kernel.org | Patch |
| https://git.kernel.org/stable/c/d61482be4aae1835b78875761206241835a7510e | kernel.org | Patch |
| https://git.kernel.org/stable/c/f55b383070170e988e4dec28be2af1714d258521 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.22, < 6.6.140 >= 6.7, < 6.12.86 >= 6.13, < 6.18.27 >= 6.19, < 7.0.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| May 30, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |