rxrpc: only handle RESPONSE during service challenge

Summary

In the Linux kernel, the following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challenge Only process RESPONSE packets while the service connection is still in RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before running response verification and security initialization, then use a local secured flag to decide whether to queue the secured-connection work after the state transition. This keeps duplicate or late RESPONSE packets from re-running the setup path and removes the unlocked post-transition state test.

Timeline

1. Apr 25, 2026, 8:46 AM UTCCVE published
2. Oct 16, 2026, 3:12 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 19, 2026, 6:56 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 17926a79320afa9b95df6b977b40cca6d8713cea · fixed in a1a8efde03a40b6c658d580e96644d9b9a2a0d3a; From 17926a79320afa9b95df6b977b40cca6d8713cea · fixed in 6c3a0fbdafef8316e34ae22333e317a341e737cd; From 17926a79320afa9b95df6b977b40cca6d8713cea · fixed in 0afdfd4941c1b60a1f5c361760daa970edca60cd; From 17926a79320afa9b95df6b977b40cca6d8713cea · fixed in a6bcf8010af093fe04f7100562e9542ab7882585; From 17926a79320afa9b95df6b977b40cca6d8713cea · fixed in 29b44d904dceb832be880def08b8cb17a0aba91c; From 17926a79320afa9b95df6b977b40cca6d8713cea · fixed in d0035e634dae83237ab7f5681eb52b2f65d0ceb8; From 17926a79320afa9b95df6b977b40cca6d8713cea · fixed in 03fd2ef73cb4ffd0af100a95b634af54f474414e; From 17926a79320afa9b95df6b977b40cca6d8713cea · fixed in c43ffdcfdbb5567b1f143556df8a04b4eeea041c

• Linux Linux

  2.6.22

• KernelLinux

  From 2.6.22 · fixed in 5.10.258; From 5.11.0 · fixed in 5.15.209; From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.136; From 6.7.0 · fixed in 6.12.84; From 6.13.0 · fixed in 6.18.23; From 6.19.0 · fixed in 6.19.13

References 8