The vulnerability arises in the Linux kernel’s rxrpc protocol handlers. When a packet is not cloned but carries externally owned paged fragments—such as those injected via splice() into a UDP socket or attached through an skb fragment list—the kernel bypasses the linear‑copy routine and enters an in‑place decryption path. In that path, the fragment pages are bound directly into the AEAD/skcipher scatter‑gather list used for decryption. This allows an attacker to potentially influence or read memory that is shared with other contexts, thereby exposing sensitive data or corrupting packet contents, which could lead to memory corruption and potentially remote code execution. The defensive change extends the gate to unshare packets that have fragment lists or shared fragments, ensuring that all externally shared fragment pages are copied before decryption. This mitigates the risk of memory corruption or unauthorized data disclosure. The vulnerability can be triggered via network traffic using the rxrpc protocol. While no exploit code is publicly known, the attack surface is significant for systems that process externally shared packet fragments, such as those involving splice or fragmented UDP sockets. The EPSS score is unavailable, and the issue is not listed in CISA KEV, suggesting that existing coverage may be limited. Nonetheless, the potential for data leakage or memory corruption makes this a high‑risk flaw that can be exploited remotely by an attacker who can inject crafted rxrpc packets.

Affected systems are Linux kernel distributions that implement the rxrpc protocol. The advisory does not list specific kernel version ranges; therefore all kernels released prior to the commit that introduced the unshare fix are considered potentially vulnerable. No particular distribution or vendor is singled out beyond the Linux kernel itself.

The advisory shows no publicly available exploits and the EPSS score is not listed. The lack of a KEV designation suggests that automated detection tools may not identify this vulnerability immediately. Nevertheless, the vulnerability permits an attacker to send crafted rxrpc packets that contain externally shared fragment pages; if the kernel ignores proper cloning, decrypted payloads can be read or corrupted in place, which could lead to memory corruption or even remote code execution. Because the exact CVSS score is not provided, the precise severity is unknown, but the potential impact and ease of exploitation via standard network traffic imply a high risk for systems that allow rxrpc traffic.