---
id: CVE-2026-46000
title: 'rxrpc: Fix conn-level packet handling to unshare RESPONSE packets'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rxrpc: Fix conn-level packet handling to unshare RESPONSE packets

  The security operations that verify the RESPONSE packets decrypt bits of it
  in place - however, the s…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea <
    ae19f6a54206534a85830dd92985f5f41441d241
  - >-
    Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea <
    c0428a22daf69714dc042b67ea759956b74c74e5
  - >-
    Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea <
    98a2046d155f73f6cf5d2c493c5e09b4963e2e12
  - >-
    Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea <
    ca71ac2de389b01eecdc48bfafbdf073ec232044
  - >-
    Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea <
    d9b93a0f57ca5f6831bfaa34014b6cd705564a00
  - >-
    Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea <
    24481a7f573305706054c59e275371f8d0fe919f
  - Linux 2.6.22
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:04:37.110506Z'
published: '2026-05-27'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:13:31.122Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46000'
references:
  - url: 'https://git.kernel.org/stable/c/ae19f6a54206534a85830dd92985f5f41441d241'
  - url: 'https://git.kernel.org/stable/c/c0428a22daf69714dc042b67ea759956b74c74e5'
  - url: 'https://git.kernel.org/stable/c/98a2046d155f73f6cf5d2c493c5e09b4963e2e12'
  - url: 'https://git.kernel.org/stable/c/ca71ac2de389b01eecdc48bfafbdf073ec232044'
  - url: 'https://git.kernel.org/stable/c/d9b93a0f57ca5f6831bfaa34014b6cd705564a00'
  - url: 'https://git.kernel.org/stable/c/24481a7f573305706054c59e275371f8d0fe919f'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.05195
ingestedAt: '2026-11-05T15:02:32.314Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix conn-level packet handling to unshare RESPONSE packets

The security operations that verify the RESPONSE packets decrypt bits of it
in place - however, the sk_buff may be shared with a packet sniffer, which
would lead to the sniffer seeing an apparently corrupt packet (actually
decrypted).

Fix this by handing a copy of the packet off to the specific security
handler if the packet was cloned.

## Affected

- `Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea < ae19f6a54206534a85830dd92985f5f41441d241`
- `Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea < c0428a22daf69714dc042b67ea759956b74c74e5`
- `Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea < 98a2046d155f73f6cf5d2c493c5e09b4963e2e12`
- `Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea < ca71ac2de389b01eecdc48bfafbdf073ec232044`
- `Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea < d9b93a0f57ca5f6831bfaa34014b6cd705564a00`
- `Linux >= 17926a79320afa9b95df6b977b40cca6d8713cea < 24481a7f573305706054c59e275371f8d0fe919f`
- `Linux 2.6.22`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.