The Linux kernel’s rxrpc module contains a flaw that allows a malformed RXKAD response ticket to be parsed as plaintext even when decryption fails. Because the kernel does not verify the success of the decryption, attacker‑controlled data can be passed to the ticket parser, which may lead to kernel memory corruption and arbitrary code execution inside the privileged kernel context. The weakness is classified as CWE‑252 (Unchecked Return Value) and CWE‑754 (Improper Handling of Encryption and Decryption Operations).

The issue affects any Linux kernel release that incorporates the rxrpc subsystem before the patch was applied, including kernels from 2.6.22 and all 7.0 release candidates (rc1 through rc7).

With a CVSS score of 9.8 it is deemed critical. The EPSS score of less than 1% indicates a low probability of widespread exploitation, and it is not listed in CISA’s KEV catalog. Although the vulnerability is network accessible, the likely attack vector is inferred from the description: an attacker must transmit a specially crafted RXKAD response to a system that accepts rxrpc connections from an untrusted source, and the kernel will only report a failure after the malformed ticket is parsed. If an adversary can expose a vulnerable host to the rxrpc interface, this can be leveraged for remote code execution.