CVE-2026-31635 (GCVE-0-2026-31635)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:44 – Updated: 2026-04-24 14:44
VLAI?
Title
rxrpc: fix oversized RESPONSE authenticator length check
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an impossible length and hit BUG_ON(len). Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: RIP: __skb_to_sgvec() [net/core/skbuff.c:5285 (discriminator 1)] Call Trace: skb_to_sgvec() [net/core/skbuff.c:5305] rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81] rxgk_verify_response() [net/rxrpc/rxgk.c:1268] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Reject authenticator lengths that exceed the remaining packet payload.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a , < beee051f259acd286fed64c32c2b31e6f5097eb5 (git)
Affected: 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a , < e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305 (git)
Affected: 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a , < a2567217ade970ecc458144b6be469bc015b23e5 (git)
Create a notification for this product.
    Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.23 , ≤ 6.18.* (semver)
Unaffected: 6.19.13 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/rxgk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "beee051f259acd286fed64c32c2b31e6f5097eb5",
              "status": "affected",
              "version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a",
              "versionType": "git"
            },
            {
              "lessThan": "e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305",
              "status": "affected",
              "version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a",
              "versionType": "git"
            },
            {
              "lessThan": "a2567217ade970ecc458144b6be469bc015b23e5",
              "status": "affected",
              "version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/rxgk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix oversized RESPONSE authenticator length check\n\nrxgk_verify_response() decodes auth_len from the packet and is supposed\nto verify that it fits in the remaining bytes. The existing check is\ninverted, so oversized RESPONSE authenticators are accepted and passed\nto rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an\nimpossible length and hit BUG_ON(len).\n\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\n\nRIP: __skb_to_sgvec()\n  [net/core/skbuff.c:5285 (discriminator 1)]\nCall Trace:\n skb_to_sgvec() [net/core/skbuff.c:5305]\n rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]\n rxgk_verify_response() [net/rxrpc/rxgk.c:1268]\n rxrpc_process_connection()\n   [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n    net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n   [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nReject authenticator lengths that exceed the remaining packet payload."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T14:44:49.963Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/beee051f259acd286fed64c32c2b31e6f5097eb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2567217ade970ecc458144b6be469bc015b23e5"
        }
      ],
      "title": "rxrpc: fix oversized RESPONSE authenticator length check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31635",
    "datePublished": "2026-04-24T14:44:49.963Z",
    "dateReserved": "2026-03-09T15:48:24.125Z",
    "dateUpdated": "2026-04-24T14:44:49.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31635",
      "date": "2026-04-25",
      "epss": "0.00017",
      "percentile": "0.04073"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31635\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-24T15:16:42.820\",\"lastModified\":\"2026-04-24T17:51:40.810\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: fix oversized RESPONSE authenticator length check\\n\\nrxgk_verify_response() decodes auth_len from the packet and is supposed\\nto verify that it fits in the remaining bytes. The existing check is\\ninverted, so oversized RESPONSE authenticators are accepted and passed\\nto rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an\\nimpossible length and hit BUG_ON(len).\\n\\nDecoded from the original latest-net reproduction logs with\\nscripts/decode_stacktrace.sh:\\n\\nRIP: __skb_to_sgvec()\\n  [net/core/skbuff.c:5285 (discriminator 1)]\\nCall Trace:\\n skb_to_sgvec() [net/core/skbuff.c:5305]\\n rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]\\n rxgk_verify_response() [net/rxrpc/rxgk.c:1268]\\n rxrpc_process_connection()\\n   [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\\n    net/rxrpc/conn_event.c:386]\\n process_one_work() [kernel/workqueue.c:3281]\\n worker_thread()\\n   [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\\n kthread() [kernel/kthread.c:436]\\n ret_from_fork() [arch/x86/kernel/process.c:164]\\n\\nReject authenticator lengths that exceed the remaining packet payload.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a2567217ade970ecc458144b6be469bc015b23e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/beee051f259acd286fed64c32c2b31e6f5097eb5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.