The vulnerability in the Linux kernel’s rxrpc module allows an attacker to craft a malformed RXKAD response ticket that fails decryption but is still parsed as plaintext. Because the kernel does not verify that the decryption succeeded, the parser can be fed attacker‑controlled data, potentially leading to arbitrary code execution or kernel memory corruption. This flaw falls under CWE‑252 (Unchecked Return Value) and NVD‑CWE‑noinfo indicates no further classification.

The issue affects all Linux kernel releases that include the rxrpc subsystem before the mitigations were applied, including Linux kernel 2.6.22 and the 7.0 release candidates (rc1 through rc7).

With a CVSS score of 9.8 the weakness is deemed critical. The EPSS score of less than 1% suggests a low probability of widespread exploitation, yet the failure is not listed in CISA’s KEV catalog, indicating it remains a known but not actively leveraged vulnerability. Attackers would need to send a specially crafted RXKAD response over the network to a system that uses the rxrpc protocol, and the kernel would abort the connection only after the malformed ticket is processed. This remote network attack path makes the vulnerability especially relevant for servers or services that expose the rxrpc interface to untrusted hosts.