Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challenge Only process RESPONSE packets while the service connection is still in RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before running response verification and security initialization, then use a local secured flag to decide whether to queue the secured-connection work after the state transition. This keeps duplicate or late RESPONSE packets from re-running the setup path and removes the unlocked post-transition state test.
References (8)
Core 8
Core References
Scores
CVSS v3
7.5
EPSS
0.0039
EPSS Percentile
31.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
Status
published
Products (27)
linux/Kernel
2.6.22 - 5.10.258linux
linux/Kernel
5.11.0 - 5.15.209linux
linux/Kernel
5.16.0 - 6.1.175linux
linux/Kernel
6.13.0 - 6.18.23linux
linux/Kernel
6.19.0 - 6.19.13linux
linux/Kernel
6.2.0 - 6.6.136linux
linux/Kernel
6.7.0 - 6.12.84linux
Linux/Linux
< 2.6.22
Linux/Linux
17926a79320afa9b95df6b977b40cca6d8713cea - 03fd2ef73cb4ffd0af100a95b634af54f474414e
Linux/Linux
17926a79320afa9b95df6b977b40cca6d8713cea - 0afdfd4941c1b60a1f5c361760daa970edca60cd
... and 17 more
Published
Apr 25, 2026
Tracked Since
Apr 25, 2026