---
id: CVE-2026-45988
title: 'rxrpc: Fix re-decryption of RESPONSE packets'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rxrpc: Fix re-decryption of RESPONSE packets

  If a RESPONSE packet gets a temporary failure during processing, it may end
  up in a partially decrypted state - and then g…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea <
    d61482be4aae1835b78875761206241835a7510e
  - >-
    Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea <
    7b89868305052b94a91b708c462bc2281fa42a4a
  - >-
    Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea <
    76cb9a2d252274adfae6e293a292434631a7d472
  - >-
    Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea <
    f55b383070170e988e4dec28be2af1714d258521
  - >-
    Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea <
    0422e7a4883f25101903f3e8105c0808aa5f4ce9
  - Linux 2.6.22
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:18:47.821756Z'
published: '2026-05-27'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:48.289Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45988'
references:
  - url: 'https://git.kernel.org/stable/c/d61482be4aae1835b78875761206241835a7510e'
  - url: 'https://git.kernel.org/stable/c/7b89868305052b94a91b708c462bc2281fa42a4a'
  - url: 'https://git.kernel.org/stable/c/76cb9a2d252274adfae6e293a292434631a7d472'
  - url: 'https://git.kernel.org/stable/c/f55b383070170e988e4dec28be2af1714d258521'
  - url: 'https://git.kernel.org/stable/c/0422e7a4883f25101903f3e8105c0808aa5f4ce9'
tags:
  - cve.org
epss: 0.00457
epssPercentile: 0.38204
ingestedAt: '2026-10-16T17:24:46.702Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix re-decryption of RESPONSE packets

If a RESPONSE packet gets a temporary failure during processing, it may end
up in a partially decrypted state - and then get requeued for a retry.

Fix this by just discarding the packet; we will send another CHALLENGE
packet and thereby elicit a further response.  Similarly, discard an
incoming CHALLENGE packet if we get an error whilst generating a RESPONSE;
the server will send another CHALLENGE.

## Affected

- `Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea < d61482be4aae1835b78875761206241835a7510e`
- `Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea < 7b89868305052b94a91b708c462bc2281fa42a4a`
- `Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea < 76cb9a2d252274adfae6e293a292434631a7d472`
- `Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea < f55b383070170e988e4dec28be2af1714d258521`
- `Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea < 0422e7a4883f25101903f3e8105c0808aa5f4ce9`
- `Linux 2.6.22`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.