The vulnerability arises when the rxrpc protocol performs in‑place decryption of a DATA packet that is forwarded locally via splice(). This action modifies a shared packet buffer during decryption, leading to pagecache corruption and potential kernel memory corruption. The weakness corresponds to CWE-362, CWE-366, and CWE-787.

All Linux kernel implementations that use the rxrpc protocol without the bounce‑buffer decrypt fix or that have not yet received the patch are affected. The vulnerable code path exists in any kernel where rxrpc processes DATA packets locally via splice() without isolating decryption from the shared buffer. The affected versions include Kernel 5.3, its release candidates 5.3rc7–rc8, Kernel 7.1rc1 through 7.1rc4, and any build matching the generic Linux kernel CPE wildcard. Systems that have applied the patch incorporating the bounce‑buffer decryption change are not affected.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred from the description and would involve an attacker sending crafted rxrpc DATA packets over the network to trigger the vulnerable splice/decryption path. This inference is not explicitly confirmed in the advisory, so the exact exploitation pathway remains uncertain. Successful exploitation could lead to kernel memory corruption, potentially resulting in denial of service or other adverse effects.