CVE-2026-45988 | In the Linux kernel, the following vulnerability has been re… | CVSS 9.8 CRITICAL

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet gets a temporary failure during processing, it may end up in a partially decrypted state - and then get requeued for a retry. Fix this by just discarding the packet; we will send another CHALLENGE packet and thereby elicit a further response. Similarly, discard an incoming CHALLENGE packet if we get an error whilst generating a RESPONSE; the server will send another CHALLENGE.

Metadata

CVE ID: CVE-2026-45988
State: PUBLISHED
Assigner: Linux
Reserved: 2026-05-13 15:03 UTC
Published: 2026-05-27 12:55 UTC
Last updated: 2026-06-14 17:46 UTC
Vendor / Product: Linux / Linux
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products (2)

Vendor	Product	Platform	Versions
Linux	Linux	—	17926a79320afa9b95df6b977b40cca6d8713cea < d61482be4aae1835b78875761206241835a7510e, 17926a79320afa9b95df6b977b40cca6d8713cea < 7b89868305052b94a91b708c462bc2281fa42a4a, 17926a79320afa9b95df6b977b40cca6d8713cea < 76cb9a2d252274adfae6e293a292434631a7d472, 17926a79320afa9b95df6b977b40cca6d8713cea < f55b383070170e988e4dec28be2af1714d258521 …
Linux	Linux	—	2.6.22, 0 < 2.6.22, 6.6.140 ≤ 6.6., 6.12.86 ≤ 6.12. …

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (5)