A bug in the Linux kernel’s RXRPC protocol handling allows a reply packet to be processed before any request data has been sent. The flaw, manifested in rxrpc_receiving_reply(), can cause the rxrpc_rotate_tx_window() routine to dereference an empty transmit queue, leading to a kernel oops and a system panic. This flaw represents a classic denial of service weakness that could be exercised locally or remotely if the vulnerable protocol is exposed, and it falls under CWEs such as Improper Initialization and Use After Free.

The vulnerability is present in all Linux kernel releases that lack the patch introduced by the commit a58e33405acd2584e730c1da72635f822ada6b49 (and related updates). It applies to the Linux operating system across all vendor distributions unless the affected kernel version has been upgraded or the RXRPC protocol has been disabled.

The CVSS score is 7.5, and the EPSS score is less than 1%, indicating a relatively high severity but low exploitation probability. The feature is not known to be exploited in the wild and is not listed in CISA’s KEV catalog. The likely attack vector is through network traffic that triggers the RXRPC service, making the issue both a local and remote denial of service concern for systems that enable the protocol. Operating systems that do not use RXRPC or have the protocol disabled will not be affected, but any unpatched kernel that handles RXRPC traffic remains at risk.