The vulnerability involves the rxrpc protocol in the Linux kernel; a temporary processing failure during the handling of a RESPONSE packet can leave the packet partially decrypted, and the kernel would then requeue it for a retry, potentially allowing an attacker to observe incomplete cryptographic material. This flaw represents a CWE‑372 weakness where incomplete removal of partially decrypted data could lead to information leakage. The patch simply discards the malformed packet and initiates a fresh challenge/response exchange, removing the possibility of re‑decryption of partially‑decrypted data and no confirmed information disclosure has been reported.

All releases of the Linux kernel that implement the rxrpc protocol are affected; the advisory lists the entire Linux kernel family with no specific version ranges, so administrators should verify their kernel version and apply the patch when available.

The CVSS score of 9.8 indicates critical severity while the EPSS score of <1% suggests a very low likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog; the most likely attack vector is network‑based, with an adversary sending or manipulating rxrpc packets to trigger a temporary failure; because no exploit has been publicly documented and the flaw only exposes partially decrypted data, the concrete risk to confidentiality, integrity, or availability remains uncertain, yet the high severity warrants timely remediation