Linux Kernel up to 6.16.8 rxrpc net/rxrpc/rxgk_app.c rxgk_yfs_decode_ticket data authenticity

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.16.8. It has been rated as critical. The impacted element is the function rxgk_yfs_decode_ticket of the file net/rxrpc/rxgk_app.c of the component rxrpc. The manipulation leads to data authenticity. This vulnerability is traded as CVE-2025-39962. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.16.8. This issue affects the function rxgk_yfs_decode_ticket of the file net/rxrpc/rxgk_app.c of the component rxrpc. The manipulation with an unknown input leads to a data authenticity vulnerability. Using CWE to declare the problem leads to CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix untrusted unsigned subtract Fix the following Smatch static checker warning: net/rxrpc/rxgk_app.c:65 rxgk_yfs_decode_ticket() warn: untrusted unsigned subtract. 'ticket_len - 10 * 4' by prechecking the length of what we're trying to extract in two places in the token and decoding for a response packet. Also use sizeof() on the struct we're extracting rather specifying the size numerically to be consistent with the other related statements.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2025-39962 since 04/16/2025. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/03/2026).

Upgrading to version 6.16.9 eliminates this vulnerability. Applying the patch 71571e187106631a8127f2dde780f35caa358d33/2429a197648178cd4dc930a9d87c13c547460564 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-33336). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.16.0
• 6.16.1
• 6.16.2
• 6.16.3
• 6.16.4
• 6.16.5
• 6.16.6
• 6.16.7
• 6.16.8

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion