CVE-2026-45988

A flaw was found in the Linux kernel's rxrpc subsystem. When an rxrpc RESPONSE packet experiences a temporary processing failure, it may enter a partially decrypted state and be re-queued for another attempt. This incorrect handling of partially decrypted packets could lead to communication disruptions or resource exhaustion within the rxrpc subsystem, potentially impacting the availability of services relying on rxrpc.

A flaw of moderate impact was found in the Linux kernel's rxrpc protocol implementation as shipped in Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2. When an rxrpc RESPONSE packet encounters a temporary failure during processing, it can be left in a partially decrypted state and then requeued for a retry; the subsequent re-decryption attempt corrupts the handling of the protocol payload and can disrupt rxrpc-based communication, impacting the availability of services that rely on rxrpc. There is no impact on confidentiality or integrity. Red Hat Enterprise Linux 6, 7, and 8 are not affected by this flaw because the vulnerable code is not present in those releases. The fix is currently deferred for the affected products; the residual risk is limited to the availability of rxrpc-dependent workloads, and triggering the issue depends on rxrpc packet processing experiencing a transient failure. The severity in the upstream CVE record (9.8, Critical) differs significantly from Red Hat's assessment of Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the flaw affects only the availability of the rxrpc subsystem and does not lead to confidentiality or integrity compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.