{"id":"CVE-2026-46085","state":"PUBLISHED","title":"rxrpc: Fix rxkad crypto unalignment handling","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix rxkad crypto unalignment handling\n\nFix handling of a packet with a misaligned crypto length.  Also handle\nnon-ENOMEM errors from decryption by aborting.  Further, remove the\nWARN_ON_ONCE() so that it can't be remotely triggered (a trace line can\nstill be emitted).","publishedAt":"2026-05-27T12:58:27.125Z","updatedAt":"2026-08-05T12:29:33.154Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9853917f9edf08efb0b55c26d9eb8340f126d9e9","status":"affected","lessThan":"f1c6bd0cc786a8fa74829ce3c4b3673944a308f4","versionType":"git"},{"version":"e9c369d58785044427450350ad32d6a2497fb379","status":"affected","lessThan":"440d20d95e844b657a93a0b2dcc2aae155efdce6","versionType":"git"},{"version":"bf4d6e4a6856eedeb7f66eb91224115bfff4e2cb","status":"affected","lessThan":"f0d3efd03b2a9e0f1ffa6df8fcb264af3d494286","versionType":"git"},{"version":"f93af41b9f5f798823d0d0fb8765c2a936d76270","status":"affected","lessThan":"af9271eb666d07b6f65612dc160a47f7cb5220ed","versionType":"git"},{"version":"f93af41b9f5f798823d0d0fb8765c2a936d76270","status":"affected","lessThan":"def304aae2edf321d2671fd6ca766a93c21f877e","versionType":"git"},{"version":"5cdf57eda01a1ffaeb61ac39ec4dcc94a690431e","status":"affected","versionType":"git"},{"version":"6.6.135","status":"affected","lessThan":"6.6.140","versionType":"semver"},{"version":"6.12.82","status":"affected","lessThan":"6.12.86","versionType":"semver"},{"version":"6.18.23","status":"affected","lessThan":"6.18.27","versionType":"semver"},{"version":"6.19.13","status":"affected","lessThan":"6.20","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/trace/events/rxrpc.h","net/rxrpc/rxkad.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.0","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.86","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.27","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.4","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/trace/events/rxrpc.h","net/rxrpc/rxkad.c"]}],"references":["https://git.kernel.org/stable/c/f1c6bd0cc786a8fa74829ce3c4b3673944a308f4","https://git.kernel.org/stable/c/440d20d95e844b657a93a0b2dcc2aae155efdce6","https://git.kernel.org/stable/c/f0d3efd03b2a9e0f1ffa6df8fcb264af3d494286","https://git.kernel.org/stable/c/af9271eb666d07b6f65612dc160a47f7cb5220ed","https://git.kernel.org/stable/c/def304aae2edf321d2671fd6ca766a93c21f877e"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:07.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/46xxx/CVE-2026-46085.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-46085","state":"PUBLISHED","datePublished":"2026-05-27T12:58:27.125Z","dateUpdated":"2026-08-05T12:29:33.154Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-13T15:03:33.096Z"},"containers":{"cna":{"title":"rxrpc: Fix rxkad crypto unalignment handling","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix rxkad crypto unalignment handling\n\nFix handling of a packet with a misaligned crypto length.  Also handle\nnon-ENOMEM errors from decryption by aborting.  Further, remove the\nWARN_ON_ONCE() so that it can't be remotely triggered (a trace line can\nstill be emitted)."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9853917f9edf08efb0b55c26d9eb8340f126d9e9","status":"affected","lessThan":"f1c6bd0cc786a8fa74829ce3c4b3673944a308f4","versionType":"git"},{"version":"e9c369d58785044427450350ad32d6a2497fb379","status":"affected","lessThan":"440d20d95e844b657a93a0b2dcc2aae155efdce6","versionType":"git"},{"version":"bf4d6e4a6856eedeb7f66eb91224115bfff4e2cb","status":"affected","lessThan":"f0d3efd03b2a9e0f1ffa6df8fcb264af3d494286","versionType":"git"},{"version":"f93af41b9f5f798823d0d0fb8765c2a936d76270","status":"affected","lessThan":"af9271eb666d07b6f65612dc160a47f7cb5220ed","versionType":"git"},{"version":"f93af41b9f5f798823d0d0fb8765c2a936d76270","status":"affected","lessThan":"def304aae2edf321d2671fd6ca766a93c21f877e","versionType":"git"},{"version":"5cdf57eda01a1ffaeb61ac39ec4dcc94a690431e","status":"affected","versionType":"git"},{"version":"6.6.135","status":"affected","lessThan":"6.6.140","versionType":"semver"},{"version":"6.12.82","status":"affected","lessThan":"6.12.86","versionType":"semver"},{"version":"6.18.23","status":"affected","lessThan":"6.18.27","versionType":"semver"},{"version":"6.19.13","status":"affected","lessThan":"6.20","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/trace/events/rxrpc.h","net/rxrpc/rxkad.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.0","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.86","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.27","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.4","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/trace/events/rxrpc.h","net/rxrpc/rxkad.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f1c6bd0cc786a8fa74829ce3c4b3673944a308f4"},{"url":"https://git.kernel.org/stable/c/440d20d95e844b657a93a0b2dcc2aae155efdce6"},{"url":"https://git.kernel.org/stable/c/f0d3efd03b2a9e0f1ffa6df8fcb264af3d494286"},{"url":"https://git.kernel.org/stable/c/af9271eb666d07b6f65612dc160a47f7cb5220ed"},{"url":"https://git.kernel.org/stable/c/def304aae2edf321d2671fd6ca766a93c21f877e"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - rxrpc is the UDP-based AFS RPC protocol; the vulnerable code processes DATA packets received from a remote network peer, and AFS cells routinely traverse the internet.\nAC:L - The attacker fully controls the DATA payload length (UDP datagram size minus headers) and can reliably set it to a non-multiple of 8; the rxkad checksum does not cover the data length, so the misaligned packet reliably reaches the crypto path.\nPR:N - An on-path attacker modifying an in-flight packet, or a malicious server the victim client connects to, needs no credentials or privileges on the target system since the 16-bit checksum gate is independent of the data length.\nUI:N - Received DATA packets are decrypted/verified automatically during normal call processing; tampering with packets of an existing connection requires no victim action.\nS:U - The triggered WARN/panic is contained within the kernel's own security authority and crosses no privilege or virtualization boundary.\nC:N - The bug only causes a crypto error path to WARN; no kernel memory is read or disclosed to the remote attacker.\nI:N - No memory is corrupted or modified—the misaligned length is rejected by the cipher, so there is no write primitive or data tampering.\nA:H - The remotely-triggerable WARN_ON_ONCE causes a kernel panic on the common panic_on_warn configuration, yielding a full denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:29:33.154Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.135","versionEndExcluding":"6.6.140"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.82","versionEndExcluding":"6.12.86"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.23","versionEndExcluding":"6.18.27"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0","versionEndExcluding":"7.0.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0","versionEndExcluding":"7.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}