Technical impact
The vulnerability arises when skb_unshare() fails to unshare a packet due to an allocation failure in rxrpc_input_packet(). The skb pointer in the parent rxrpc_io_thread() is then set to NULL, causing trace_rxrpc_rx_done() to dereference a NULL pointer and trigger a kernel oops. The flaw, identified as CWE-416 and CWE-825, can lead to a kernel crash and a denial of service. Based on the description, the attack vector is inferred to involve the transmission of malicious RXRPC packets that trigger the allocation failure and null dereference.
Affected Systems
All Linux kernel builds that include the RXRPC networking stack and have not yet incorporated the fix commit (c/1f2740150f904bfa60e4bad74d65add3ccb5e7f8) are potentially affected. The patch was applied to the mainline kernel, so any system shipping a kernel version prior to that commit is at risk. Since specific version ranges are not listed, administrators should consult the kernel changelog or release notes to determine whether their kernel includes the referenced improvements.
Risk and Exploitability
The CVSS score of 7.8 indicates high severity for this kernel flaw. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA's KEV catalog, suggesting no known active exploitation at the time of the advisory. Exploitation would require an attacker to send RXRPC traffic that induces an allocation failure, a scenario that might be difficult to reliably reproduce in a stable production environment. Nonetheless, a successful exploit would result in a non‑privileged kernel crash, disrupting availability and potentially allowing privilege escalation if the crash is leveraged in a broader attack chain.
Ubuntu USN