CVE-2026-46039 is a vulnerability in the Linux kernel's rxgk subsystem where a potential integer overflow could occur during the length check in the rxgk_extract_token() function. The original code rounded up the value to be tested, which might overflow, leading to incorrect length validation. The fix changes this behavior to round down the size of the available data, preventing the overflow. This vulnerability affects numerous Linux kernel versions, including many specific builds of 4.15, 5.x, 6.x, and 7.x kernels prior to the fixed versions. The issue has been addressed in official Ubuntu kernel updates, requiring system reboot and recompilation of third-party kernel modules due to ABI changes.

The integer overflow in the length check could allow an attacker to bypass length validation in the rxgk subsystem, potentially leading to memory corruption or other security issues. The CVSS score of 9.8 indicates critical impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. This means a remote attacker could exploit this vulnerability to fully compromise the affected system.

A patch is available and should be applied promptly. Ubuntu has released updated Linux kernel packages that fix this vulnerability. After applying the update, a system reboot is required to activate the fixes. Due to an ABI change, all third-party kernel modules must be recompiled and reinstalled. Users should follow the vendor's update instructions and ensure all kernel modules are compatible with the new kernel version.