The flaw resides in the rxrpc packet path of the Linux kernel. When a packet with externally shared paged fragments is received, the kernel does not clone the socket buffer but proceeds directly into an in‑place decryption routine that binds the fragment pages to the AEAD scatter‑gather list. This bypasses normal linear‑copying and can cause buffer read/write errors consistent with CWE‑123 and CWE‑787, resulting in arbitrary kernel memory corruption.

All Linux kernel releases prior to the commit that added the unshare check are affected, including the generic Linux kernel as well as versions 5.3, 5.3‑rc7, 5.3‑rc8, 7.1‑rc1, and 7.1‑rc2. Any distribution shipping those kernels and accepting rxrpc traffic is at risk.

The CVSS score of 7.8 indicates high severity, but the EPSS score of 2 % suggests a low likelihood of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. A remote attacker would need to craft rxrpc packets that trigger the vulnerable path, such as using splice() on a UDP socket or constructing packets with externally shared fragment lists, to exploit the kernel memory corruption that could lead to privilege escalation or arbitrary code execution.