The Linux kernel vulnerability tracked as CVE-2026-45998 has been assigned a CVSS v3.1 base score of 7.8 (High) by the National Vulnerability Database, confirming that a local attacker could exploit a use-after-free flaw in the RxRPC networking subsystem to crash the system or potentially execute code with elevated privileges. Patches have been circulating in stable kernel trees since late May 2026, and most major Linux distributions have now shipped updates. If you haven’t applied this fix yet, the window for a low-effort kernel update is closing.

What Exactly Is CVE-2026-45998?

CVE-2026-45998 is a memory-safety bug in the Linux kernel’s RxRPC implementation—the code that handles the AFS-style Remote Procedure Call protocol used by certain networked filesystems and services. The vulnerability arises when skb_unshare() fails to duplicate a network packet buffer due to a memory allocation error inside rxrpc_input_packet().

The faulty logic zeroes out the packet pointer in the parent I/O thread, but a subsequent trace call (trace_rxrpc_rx_done()) still expects a valid object. That mismatch can trigger a use-after-free (UAF) condition, leading to a kernel oops or, in the worst case, a controlled memory corruption primitive for privilege escalation.

According to the NVD and Red Hat’s own assessment, the attack vector is local: an attacker needs low-privilege access to the host (e.g., an unprivileged shell) and the ability to trigger RxRPC packet processing—either by sending crafted network traffic or by interacting with a local RxRPC service. The NVD’s 7.8 score reflects the combination of a relatively low attack complexity (AC:L) and high impact on confidentiality, integrity, and availability.

Which Systems Are at Risk?

The vulnerability affects Linux kernel versions 6.2 through 7.0.x before the fix. Specifically, the upstream commit that introduced the bug landed in kernel 2d1faf7a0ca3 (around the 6.2 development cycle), and patches have been backported to the following stable branches:

  • 6.6.140 and later (6.6.x series)
  • 6.12.86 and later (6.12.x series)
  • 6.18.27 and later (6.18.x series)
  • 7.0.4 and later (7.0.x series)
  • All 7.1+ kernels are unaffected.

Red Hat has confirmed that Red Hat Enterprise Linux 9 and 10 are affected, including AppStream, BaseOS, CodeReady Linux Builder, and Real Time variants. RHEL 6, 7, and 8 are not affected. Oracle Linux has issued errata ELSA-2026-50259 for its 9.x and 10.x derivatives. Other enterprise distributions (SUSE, Ubuntu, Debian) have incorporated the fix into their regular kernel updates, though you’ll need to check your specific package version.

To quickly check your kernel’s vulnerability status, run:

uname -r

Then compare the version against your distribution’s security advisory. A raw kernel version alone isn’t enough—vendors often backport patches without bumping the major version string.

What to Do Right Now

1. Apply your distribution’s kernel update.
This is the only complete fix. Reboot into the new kernel. Most enterprise Linux distributions have already released advisory updates. For Red Hat, look for RHSA-2026:34911. For Oracle, see ELSA-2026-50259. For others, search your vendor’s CVE tracker for CVE-2026-45998.

2. If an immediate reboot isn’t possible, mitigate.
If you cannot reboot right away, check whether the RxRPC kernel module is loaded:

lsmod | grep rxrpc

If it’s not loaded and your system doesn’t require it, you can blacklist it to prevent loading:

echo "blacklist rxrpc" > /etc/modprobe.d/disable-rxrpc.conf

But beware: if RxRPC is compiled into the kernel (not a loadable module), this won’t work. On RHEL, it is typically compiled as a module, but verify.

3. For Windows administrators managing Linux VMs, containers, or WSL instances.
If you have Linux workloads running on Windows hosts (via Hyper-V, WSL2, or Azure VMs), ensure those guest kernels are updated. A compromised Linux VM can pivot to the host or steal credentials. Patch your container hosts—containers share the kernel, and the RxRPC code is reachable from any container if the module is loaded.

4. Update your vulnerability scanners.
Some scanners missed CVE-2026-45998 during its “unscored” period. Force a rescan now that NVD enrichment is complete; otherwise, you may have false negatives in your compliance reports.

How This Bug Flew Under the Radar—and Why It Still Matters

CVE-2026-45998 was initially published by kernel.org on May 27, 2026, but NVD did not enrich the record with a CVSS score until June 16. During those three weeks, many automated vulnerability management tools flagged the CVE as “N/A” severity, effectively de‑prioritizing it. Yet the stable patches were already out.

This gap reveals a structural flaw in patch management pipelines: organizations that rely solely on CVSS scores to trigger action will always lag behind the actual availability of fixes. Kernel CVEs often appear with stable backports before the scoring databases catch up. As upstream automation pushes more fixes through the CVE assignment process, this lag will become more common.

The bug itself is a textbook regression. The RxRPC receive path was simplified in a prior cleanup, which inadvertently changed ownership assumptions around skb_unshare(). When the allocation fails, the caller NULLs the pointer that later code still dereferences. It’s the kind of subtle lifetime bug that static analyzers struggle with and that dynamic fuzzing only triggers under memory pressure.

RxRPC is not a household name, but it’s compiled and often loaded by default in many general-purpose Linux kernels because it’s part of the kernel’s networking stack. Even if you don’t use remote procedure calls, the module may be loaded automatically when needed—or it may be built-in. Attackers don’t need to find an active RxRPC service; they just need the code to be present and reachable.

Outlook: Kernel Vulnerability Management Is a Moving Target

CVE-2026-45998 won’t be the last Linux kernel CVE to arrive without a score. As the kernel community continues to formalize its CVE assignment process, expect to see more records that are actionable before they are fully scored. Defenders must learn to read these “patch-first” CVEs as operational to‑do items, not as abstract risks waiting for a database verdict.

For now, the immediate task is clear: find every Linux host in your estate—whether it’s a production server, a cloud VM, a container node, or a developer laptop—and verify it has been patched against this bug. A 7.8 CVSS score attached to a locally exploitable, privilege‑escalation‑capable vulnerability deserves a same‑week remediation timeline.

The patching process itself is routine. The real test is whether your vulnerability management program saw this coming or waited for a shiny number to light up the dashboard.