CVE-2026-64026

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg

This improves the fix for CVE-2026-43500.

Fix the pagecache corruption from in-place decryption of a DATA packet

transmitted locally by splice() by getting rid of the packet sharing in the

I/O thread and unconditionally extracting the packet content into a bounce

buffer in which the buffer is decrypted. recvmsg() (or the kernel

equivalent) then copies the data from the bounce buffer to the destination

buffer. The sk_buff then remains unmodified.

This has an additional advantage in that the packet is then arranged in the

buffer with the correct alignment required for the crypto algorithms to

process directly. The performance of the crypto does seem to be a little

faster and, surprisingly, the unencrypted performance doesn't seem to

change much - possibly due to removing complexity from the I/O thread.

Yet another advantage is that the I/O t

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References