All vulnerabilities
CVE-2026-31635

Linux: rxrpc: fix oversized RESPONSE authenticator length check

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 18 May 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)1.02%Chance of exploitation activity in the next 30 days, higher than 63% of CVEs. Scored 28 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published24 Apr 2026Updated 5 Aug 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Timeline

  1. 24 Apr 2026, 14:44 UTCPublishedCVE List
  2. 28 Oct 2026, 09:52 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: fix oversized RESPONSE authenticator length check

rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an impossible length and hit BUG_ON(len).

Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh:

RIP: __skb_to_sgvec() [net/core/skbuff.c:5285 (discriminator 1)] Call Trace: skb_to_sgvec() [net/core/skbuff.c:5305] rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81] rxgk_verify_response() [net/rxrpc/rxgk.c:1268] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164]

Reject authenticator lengths that exceed the remaining packet payload.

Text from CVE List

Affected versions 8

  • Linuxaffected: 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a before beee051f259acd286fed64c32c2b31e6f5097eb5CVE List
  • Linuxaffected: 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a before e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305CVE List
  • Linuxaffected: 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a before a2567217ade970ecc458144b6be469bc015b23e5CVE List
  • Linuxaffected: 6.16CVE List
  • Linuxunaffected: all versions before 6.16CVE List
  • Linuxunaffected: 6.18.23 through 6.18.*CVE List
  • Linuxunaffected: 6.19.13 through 6.19.*CVE List
  • Linuxunaffected: 7.0CVE List

References 4