CVE-2026-45988 rxrpc: Fix re-decryption of RESPONSE packets
A flaw in the Linux kernel's rxrpc module allows temporary processing failures to leave packets in an inconsistent state, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45988?
CVE-2026-45988 is a critical vulnerability in Linux kernel, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix re-decryption of RESPONSE packets
If a RESPONSE packet gets a temporary failure during processing, it may end up in a partially decrypted state - and then get requeued for a retry.
Fix this by just discarding the packet; we will send another CHALLENGE packet and thereby elicit a further response. Similarly, discard an incoming CHALLENGE packet if we get an error whilst generating a RESPONSE; the server will send another CHALLENGE.
Weakness: CWE-682
Which versions are affected by CVE-2026-45988?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-45988?
Apply the vendor's patch.
Is CVE-2026-45988 being exploited?
There is no known exploitation of CVE-2026-45988 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88475, BELL-CVE-2026-45988, DEBIAN-CVE-2026-45988, GHSA-prrp-jq4x-wwq4, ROOT-OS-DEBIAN-11-CVE-2026-45988, ROOT-OS-DEBIAN-12-CVE-2026-45988 and 3 more.