The Linux kernel’s rxrpc_preparse routine lacks a length validation step in its non‑XDR key‑preparing path. An unprivileged user can submit a key with an excessively large ticket length, causing the kernel to compute a token size that exceeds the defined maximum. The kernel then triggers a WARN_ON message. This flaw aligns with CWE‑190: Integer Overflow or Wraparound, indicating a potential integer overflow that could lead to resource exhaustion or instability.

All Linux kernel implementations that include the rxrpc module are affected. The advisory does not list specific kernel versions, so any kernel containing the vulnerable code path is at risk until patched.

The CVSS score is 5.5, and the EPSS score is not available; the vulnerability is also not listed in the CISA KEV catalog. The attack is likely local, as any user with system access can craft a malicious key payload. While the kernel only logs a warning rather than crashing, repeated exploitation could lead to memory over‑commitment and a denial‑of‑service condition. Given the local nature and absence of proven remote exploitation, the overall risk is moderate but the issue should be patched promptly.