The Linux kernel’s rxrpc implementation incorrectly shared a sk_buff containing a RESPONSE packet that has been decrypted in place. If the packet was cloned, a packet sniffer on the same host could read the packet’s decrypted payload, resulting in an information disclosure of sensitive data that should remain confidential. This flaw does not provide arbitrary code execution or denial of service, but it can expose cryptographic secrets or other protected information.

All Linux kernels that include the rxrpc implementation before the fix are affected. The issue was addressed in a commit to the Linux kernel repository and applies to any distribution providing the upstream kernel without the patch. Specific version ranges are not listed in the advisory, so any kernel older than the fix should be considered vulnerable.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting that no widespread exploitation has been observed to date. Nevertheless, an attacker who can view traffic on Linux devices running the unpatched kernel, or who can execute packet‑capturing utilities locally, could exploit the flaw to read decrypted data. The lack of a listed KEV entry does not diminish the potential confidentiality impact, especially in environments handling sensitive payloads over network RPC. The CVSS score is 5.5, indicating a medium impact for affected systems.