CVE-2026-46000 rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
A packet sniffer could view decrypted data from shared RESPONSE packets in the Linux kernel's rxrpc module due to in-place decryption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46000?
CVE-2026-46000 is a medium-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
The security operations that verify the RESPONSE packets decrypt bits of it in place - however, the sk_buff may be shared with a packet sniffer, which would lead to the sniffer seeing an apparently corrupt packet (actually decrypted).
Fix this by handing a copy of the packet off to the specific security handler if the packet was cloned.
Which versions are affected by CVE-2026-46000?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46000?
Apply the vendor's patch.
Is CVE-2026-46000 being exploited?
There is no known exploitation of CVE-2026-46000 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88599, BELL-CVE-2026-46000, DEBIAN-CVE-2026-46000, GHSA-97jg-j9j8-fpm3, ROOT-OS-DEBIAN-11-CVE-2026-46000, ROOT-OS-DEBIAN-12-CVE-2026-46000 and 2 more.