The vulnerability is in the Linux kernel's rxrpc protocol. When a RESPONSE packet encounters a temporary failure during processing, it can be left partially decrypted and subsequently requeued for retry. The fix discards the packet and sends a new CHALLENGE packet, preventing the reuse of a partially decrypted payload. Because the packet can be in an incomplete state, the kernel may experience inconsistent handling or repeated retry loops, which could affect availability but does not explicitly disclose information.

All Linux kernel releases that include the rxrpc protocol are potentially affected, as the advisory references the entire kernel. Administrators should verify their running kernel version and apply any update that contains the rxrpc decryption patch when it becomes available.

The CVSS score of 9.8 indicates critical severity. The EPSS score of <1% suggests exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based, inferred from the fact that rxrpc packets traverse the network; an attacker could send malformed or manipulated rxrpc packets to trigger a temporary failure and cause the kernel to incorrectly re‑decrypt a partially processed packet. While no public exploit exists, the high severity warrants prompt remediation.