CVE-2026-46039

During ticket length verification in rxgk_extract_token(), the code incorrectly rounded up the tested value, which could lead to integer overflow and bypass of data length validation checks. The patch changes the approach to rounding down the size of available data, which eliminates the overflow risk. Incorrect length validation can result in access to memory outside the designated buffer.

An attacker may potentially gain unauthorized access to sensitive data, compromise system integrity, or cause its unavailability (respectively: C:H, I:H, A:H according to CVSS vector).

Security patches available from the vendor should be applied according to references — fixes have been published in the Linux kernel stable repository (commits: 183d37f12d1c, 43222ac484f9, 6929350080f4).

Linux kernel containing the rxgk module — specific versions indicated in vendor references (commits available in the kernel stable repository).