CVE-2026-31635 (GCVE-0-2026-31635)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:44 – Updated: 2026-08-05 12:23
VLAI
Title
rxrpc: fix oversized RESPONSE authenticator length check
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an impossible length and hit BUG_ON(len). Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: RIP: __skb_to_sgvec() [net/core/skbuff.c:5285 (discriminator 1)] Call Trace: skb_to_sgvec() [net/core/skbuff.c:5305] rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81] rxgk_verify_response() [net/rxrpc/rxgk.c:1268] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Reject authenticator lengths that exceed the remaining packet payload.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-130 - Improper Handling of Length Parameter Inconsistency
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a , < beee051f259acd286fed64c32c2b31e6f5097eb5 (git)
Affected: 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a , < e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305 (git)
Affected: 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a , < a2567217ade970ecc458144b6be469bc015b23e5 (git)
Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.23 , ≤ 6.18.* (semver)
Unaffected: 6.19.13 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31635",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-18T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-130",
                "description": "CWE-130 Improper Handling of Length Parameter Inconsistency",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T03:55:26.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/v12-security/pocs/tree/main/dirtydecrypt"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/rxgk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "beee051f259acd286fed64c32c2b31e6f5097eb5",
              "status": "affected",
              "version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a",
              "versionType": "git"
            },
            {
              "lessThan": "e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305",
              "status": "affected",
              "version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a",
              "versionType": "git"
            },
            {
              "lessThan": "a2567217ade970ecc458144b6be469bc015b23e5",
              "status": "affected",
              "version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/rxgk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix oversized RESPONSE authenticator length check\n\nrxgk_verify_response() decodes auth_len from the packet and is supposed\nto verify that it fits in the remaining bytes. The existing check is\ninverted, so oversized RESPONSE authenticators are accepted and passed\nto rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an\nimpossible length and hit BUG_ON(len).\n\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\n\nRIP: __skb_to_sgvec()\n  [net/core/skbuff.c:5285 (discriminator 1)]\nCall Trace:\n skb_to_sgvec() [net/core/skbuff.c:5305]\n rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]\n rxgk_verify_response() [net/rxrpc/rxgk.c:1268]\n rxrpc_process_connection()\n   [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n    net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n   [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nReject authenticator lengths that exceed the remaining packet payload."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - RxRPC packets are received over UDP and the vulnerable RXGK RESPONSE parser is reached from the network receive path on a listening RxRPC service. A remote peer can initiate a service call, receive a challenge, and send the malformed RESPONSE packet.\nAC:L - The trigger is a deterministic oversized authenticator length in an attacker-controlled RESPONSE packet, with no race or hard-to-control timing. A valid RXGK deployment and normal handshake state are prerequisites, but not exploit-complexity conditions beyond the attacker\u2019s packet construction.\nPR:N - The vulnerable code runs during the connection authentication handshake before the RESPONSE authenticator is accepted. No privileges on the vulnerable host are required to send the network packets that reach this path.\nUI:N - No user action is required on the victim once an affected RxRPC service is listening. The attacker can drive the packet exchange directly over the network.\nS:U - The impact is within the kernel/network service security authority of the vulnerable system. There is no guest-to-host, sandbox, or other authority-boundary escape.\nC:N - The bug passes an impossible length to skb_to_sgvec(), which reaches BUG_ON(len), and the investigated path does not expose kernel memory to the attacker. This issue is a crash path, not the separate RESPONSE parser out-of-bounds read bug.\nI:N - The oversized length does not create an attacker-controlled write or control-flow primitive in the investigated path. Execution stops at the skb_to_sgvec() BUG_ON before decrypted authenticator contents are processed.\nA:H - The malformed RESPONSE can hit BUG_ON(len) in __skb_to_sgvec(), causing a kernel oops/panic-class failure. A remote attacker can repeat the handshake and malformed packet to cause denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:59.642Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/beee051f259acd286fed64c32c2b31e6f5097eb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2567217ade970ecc458144b6be469bc015b23e5"
        }
      ],
      "title": "rxrpc: fix oversized RESPONSE authenticator length check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31635",
    "datePublished": "2026-04-24T14:44:49.963Z",
    "dateReserved": "2026-03-09T15:48:24.125Z",
    "dateUpdated": "2026-08-05T12:23:59.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31635",
      "date": "2026-08-06",
      "epss": "0.00817",
      "percentile": "0.53679"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31635\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-24T15:16:42.820\",\"lastModified\":\"2026-06-17T10:34:08.150\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: fix oversized RESPONSE authenticator length check\\n\\nrxgk_verify_response() decodes auth_len from the packet and is supposed\\nto verify that it fits in the remaining bytes. The existing check is\\ninverted, so oversized RESPONSE authenticators are accepted and passed\\nto rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an\\nimpossible length and hit BUG_ON(len).\\n\\nDecoded from the original latest-net reproduction logs with\\nscripts/decode_stacktrace.sh:\\n\\nRIP: __skb_to_sgvec()\\n  [net/core/skbuff.c:5285 (discriminator 1)]\\nCall Trace:\\n skb_to_sgvec() [net/core/skbuff.c:5305]\\n rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]\\n rxgk_verify_response() [net/rxrpc/rxgk.c:1268]\\n rxrpc_process_connection()\\n   [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\\n    net/rxrpc/conn_event.c:386]\\n process_one_work() [kernel/workqueue.c:3281]\\n worker_thread()\\n   [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\\n kthread() [kernel/kthread.c:436]\\n ret_from_fork() [arch/x86/kernel/process.c:164]\\n\\nReject authenticator lengths that exceed the remaining packet payload.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/rxrpc/rxgk.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a\",\"lessThan\":\"beee051f259acd286fed64c32c2b31e6f5097eb5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a\",\"lessThan\":\"e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a\",\"lessThan\":\"a2567217ade970ecc458144b6be469bc015b23e5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/rxrpc/rxgk.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.23\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.13\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-18T00:00:00+00:00\",\"id\":\"CVE-2026-31635\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-130\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16.1\",\"versionEndExcluding\":\"6.18.23\",\"matchCriteriaId\":\"EAE31F43-AAC5-4801-B2B2-119D62A532A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.13\",\"matchCriteriaId\":\"1490EF9B-9080-481C-8D22-1306AAE664E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6238B17D-C12B-458F-A138-97039BFC4595\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a2567217ade970ecc458144b6be469bc015b23e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/beee051f259acd286fed64c32c2b31e6f5097eb5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/v12-security/pocs/tree/main/dirtydecrypt\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T13:37:26+00:00",
      "cve": "CVE-2026-31635",
      "id": "CVE-2026-31635",
      "initial_release_date": "2026-04-24T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rxrpc: fix oversized RESPONSE authenticator length check",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31635.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:24:06Z",
      "cve": "CVE-2026-31635",
      "id": "CVE-2026-31635",
      "initial_release_date": "2026-04-25T01:37:26Z",
      "product_status:known_not_affected": "315",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31635",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31635.json",
      "version": "6"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-31635\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-18T13:26:31.187019Z\"}}}], \"references\": [{\"url\": \"https://github.com/v12-security/pocs/tree/main/dirtydecrypt\", \"tags\": [\"exploit\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-130\", \"description\": \"CWE-130 Improper Handling of Length Parameter Inconsistency\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-18T13:26:22.982Z\"}}], \"cna\": {\"title\": \"rxrpc: fix oversized RESPONSE authenticator length check\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a\", \"lessThan\": \"beee051f259acd286fed64c32c2b31e6f5097eb5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a\", \"lessThan\": \"e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a\", \"lessThan\": \"a2567217ade970ecc458144b6be469bc015b23e5\", \"versionType\": \"git\"}], \"programFiles\": [\"net/rxrpc/rxgk.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.18.23\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.19.*\"}, {\"status\": \"unaffected\", \"version\": \"7.0\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/rxrpc/rxgk.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/beee051f259acd286fed64c32c2b31e6f5097eb5\"}, {\"url\": \"https://git.kernel.org/stable/c/e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305\"}, {\"url\": \"https://git.kernel.org/stable/c/a2567217ade970ecc458144b6be469bc015b23e5\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: fix oversized RESPONSE authenticator length check\\n\\nrxgk_verify_response() decodes auth_len from the packet and is supposed\\nto verify that it fits in the remaining bytes. The existing check is\\ninverted, so oversized RESPONSE authenticators are accepted and passed\\nto rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an\\nimpossible length and hit BUG_ON(len).\\n\\nDecoded from the original latest-net reproduction logs with\\nscripts/decode_stacktrace.sh:\\n\\nRIP: __skb_to_sgvec()\\n  [net/core/skbuff.c:5285 (discriminator 1)]\\nCall Trace:\\n skb_to_sgvec() [net/core/skbuff.c:5305]\\n rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]\\n rxgk_verify_response() [net/rxrpc/rxgk.c:1268]\\n rxrpc_process_connection()\\n   [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\\n    net/rxrpc/conn_event.c:386]\\n process_one_work() [kernel/workqueue.c:3281]\\n worker_thread()\\n   [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\\n kthread() [kernel/kthread.c:436]\\n ret_from_fork() [arch/x86/kernel/process.c:164]\\n\\nReject authenticator lengths that exceed the remaining packet payload.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.23\", \"versionStartIncluding\": \"6.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19.13\", \"versionStartIncluding\": \"6.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0\", \"versionStartIncluding\": \"6.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T22:12:37.582Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-31635\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-18T13:28:04.169Z\", \"dateReserved\": \"2026-03-09T15:48:24.125Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-04-24T14:44:49.963Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.