In the Linux kernel, the flaw exists in rxrpc packet handling. When a packet carries externally owned paged fragments that are not cloned—such as fragments introduced via splice() on a UDP socket or attached through a fragment list—the kernel bypasses its usual linear copy and enters an in‑place decryption path that binds the fragment pages directly into the AEAD/skcipher scatter‑gather list. The shared fragment pages can be manipulated, leading to buffer read/write errors that match CWE‑123 and CWE‑787. The result is arbitrary kernel memory corruption.

All Linux kernel releases prior to the commit that added the unshare check are potentially vulnerable. The Common Platform Enumerations list generic Linux kernel and specific releases such as 5.3, 5.3‑rc7, 5.3‑rc8, 7.1‑rc1, and 7.1‑rc2. Therefore, most distributions that ship any of those kernels are at risk if they process rxrpc traffic with externally shared fragments.

Security ratings indicate a high risk: CVSS score 7.8 and EPSS 34% demonstrate moderate likelihood of exploitation. The vulnerability is not in CISA’s KEV catalog. Based on the description, it is inferred that a remote attacker must be able to send crafted rxrpc packets that trigger the vulnerable path—such as using splice into a UDP socket or building packets with shared fragment lists—to achieve kernel memory corruption, which could lead to privilege escalation or arbitrary code execution. No prerequisite user privileges are required, making any remote host reachable through the RxRPC service a potential attack target.