Skip to content
Fencer Vulns
high 7.5

CVE-2026-31635 json

rxrpc: fix oversized RESPONSE authenticator length check

published 2026-04-24 6 mo ago modified 2026-08-05 3 mo ago also EUVD-2026-25528

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: fix oversized RESPONSE authenticator length check

rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an impossible length and hit BUG_ON(len).

Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh:

RIP: __skb_to_sgvec() [net/core/skbuff.c:5285 (discriminator 1)] Call Trace: skb_to_sgvec() [net/core/skbuff.c:5305] rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81] rxgk_verify_response() [net/rxrpc/rxgk.c:1268] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164]

Reject authenticator lengths that exceed the remaining packet payload.

Patch / fix

  • Linux Linux 6.18.23, 6.19.13, 7.0
  • linux Debian 14 6.19.13-1

debian advisories DEBIAN-CVE-2026-31635

  • linux Ubuntu 25.10 6.17.0-40.40
  • linux-aws Ubuntu 25.10 6.17.0-1019.19
  • linux-gcp Ubuntu 25.10 6.17.0-1020.22
  • linux-raspi Ubuntu 25.10 6.17.0-1021.21
  • linux-riscv Ubuntu 25.10 6.17.0-40.40.1
  • linux-nvidia Ubuntu 26.04 LTS 7.0.0-1006.6
  • linux-oracle Ubuntu 25.10 6.17.0-1018.18
  • linux-aws-6.17 Ubuntu 24.04 LTS 6.17.0-1019.19~24.04.1

ubuntu advisories UBUNTU-CVE-2026-31635

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 10.2 6.12.0-211.40.1.el10_2
  • rv RHEL 10.2 6.12.0-211.40.1.el10_2
  • perf RHEL 10.2 6.12.0-211.40.1.el10_2
  • rtla RHEL 10.2 6.12.0-211.40.1.el10_2
  • libperf RHEL 10.2 6.12.0-211.40.1.el10_2
  • kernel-rt RHEL 10.2 6.12.0-211.40.1.el10_2
  • kernel-64k RHEL 10.2 6.12.0-211.40.1.el10_2
  • kernel-core RHEL 10.2 6.12.0-211.40.1.el10_2

red hat advisories RHSA-2026:47017

  • kernel AlmaLinux 10 6.12.0-211.40.1.el10_2
  • rv AlmaLinux 10 6.12.0-211.40.1.el10_2
  • perf AlmaLinux 10 6.12.0-211.40.1.el10_2
  • rtla AlmaLinux 10 6.12.0-211.40.1.el10_2
  • libperf AlmaLinux 10 6.12.0-211.40.1.el10_2
  • kernel-rt AlmaLinux 10 6.12.0-211.40.1.el10_2
  • kernel-64k AlmaLinux 10 6.12.0-211.40.1.el10_2
  • kernel-core AlmaLinux 10 6.12.0-211.40.1.el10_2

almalinux advisories ALSA-2026:47017

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-31635 updated cvss 7.8

kernel: rxrpc: fix oversized RESPONSE authenticator length check

  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.40.1.el10_2, perf 6.12.0-211.40.1.el10_2, rtla 6.12.0-211.40.1.el10_2, python3-perf 6.12.0-211.40.1.el10_2, kernel-devel-matched 6.12.0-211.40.1.el10_2, kernel-64k-devel-matched 6.12.0-211.40.1.el10_2, +7 more Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.40.1.el10_2, kernel-64k 6.12.0-211.40.1.el10_2, kernel-core 6.12.0-211.40.1.el10_2, kernel-tools 6.12.0-211.40.1.el10_2, kernel-modules 6.12.0-211.40.1.el10_2, kernel-64k-core 6.12.0-211.40.1.el10_2, +28 more Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.40.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.40.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.40.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.40.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.40.1.el10_2 Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.40.1.el10_2, kernel-rt-64k 6.12.0-211.40.1.el10_2, kernel-rt-core 6.12.0-211.40.1.el10_2, kernel-rt-modules 6.12.0-211.40.1.el10_2, kernel-rt-64k-core 6.12.0-211.40.1.el10_2, kernel-rt-debug-core 6.12.0-211.40.1.el10_2, +14 more Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.40.1.el10_2, kernel-rt-core 6.12.0-211.40.1.el10_2, kernel-rt-modules 6.12.0-211.40.1.el10_2, kernel-rt-debug-core 6.12.0-211.40.1.el10_2, kernel-rt-modules-core 6.12.0-211.40.1.el10_2, kernel-rt-debug-modules 6.12.0-211.40.1.el10_2, +4 more
    fixed: vendor fix RHSA-2026:47017
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/v12-security/pocs/tree/main/dirtydecrypt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
  • CWE-130 Improper Handling of Length Parameter Inconsistency
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.