In the Linux kernel’s rxrpc subsystem, the function rxgk_do_verify_authenticator performs authentication checks on received packets. A missing buffer size validation before accessing the nonce leads to a buffer overread, which may allow an attacker to read unintended kernel memory or cause a kernel crash. This vulnerability is a buffer overread (CWE‑787) and also involves improper bounds checking (CWE‑805), potentially exposing sensitive data or disrupting system availability. The likely attack vector is through crafted rxrpc packets sent over the network to the target system.

The flaw affects the Linux kernel across multiple release lines, including v6.16 and all 7.0 release candidates (rc1 through rc7). Systems running any of these kernel versions are susceptible until the patch is applied.

The CVSS score of 8.2 signifies a high severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploits. An attacker would need to send a malicious rxrpc packet to the target, which could be performed remotely over an open network, and would require the target to load the vulnerable kernel. Prompt patching is recommended to mitigate the risk.