Technical impact
In the Linux kernel’s rxrpc_post_response routine the code mistakenly compares the challenge serial number from a *cached* response against the newer packet’s private data, which makes the comparison always false. As a result, newer responses never replace older ones, so the kernel may continue to serve stale or incorrect data. This faulty logic can lead to inconsistent network state and can render an RxRPC service unresponsive, effectively causing a denial‑of‑service. The bug also involves improper handling of socket buffers. The older packet is not correctly released when a newer replacement is chosen, which creates a memory leak. The combination of stale data delivery and leaked memory constitutes the two CWE root causes that are reflected in the advisory. The vulnerability description does not explicitly state authentication bypass, so only the service disruption and memory leakage ramifications are supported by the official data.
Affected Systems
The flaw is present in any Linux kernel that contains the unpatched rxrpc implementation, including kernel 6.16 and all 7.0 release candidates from rc1 through rc7. Distributions that ship these kernel versions without the applied patch are affected.
Risk and Exploitability
The flaw is rated with a CVSS score of 7.5, placing it in the high severity range. Its EPSS score of less than 1% suggests that exploitation is currently unlikely, and it is not listed in the CISA KEV catalog. Although the description does not spell out an attack vector, it is inferred that an attacker would need to send specially crafted RxRPC packets over the network to trigger the code path. The low probability of exploitation combined with the potential for denial of service results in a moderate overall risk that still warrants timely remediation.
