CVE-2026-31636: rxrpc: fix RESPONSE authenticator parser OOB read
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: fix RESPONSE authenticator parser OOB read
rxgkverifyauthenticator() copies authlen bytes into a temporary buffer and then passes p + authlen as the parser limit to rxgkdoverifyauthenticator(). Since p is a be32 , that inflates the parser end pointer by a factor of four and lets malformed RESPONSE authenticators read past the kmalloc() buffer.
Decoded from the original latest-net reproduction logs with scripts/decodestacktrace.sh:
BUG: KASAN: slab-out-of-bounds in rxgkverifyresponse() Call Trace: dumpstacklvl() [lib/dumpstack.c:123] printreport() [mm/kasan/report.c:379 mm/kasan/report.c:482] kasanreport() [mm/kasan/report.c:597] rxgkverifyresponse() [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167 net/rxrpc/rxgk.c:1274] rxrpcprocessconnection() [net/rxrpc/connevent.c:266 net/rxrpc/connevent.c:364 net/rxrpc/connevent.c:386] processonework() [kernel/workqueue.c:3281] workerthread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] retfromfork() [arch/x86/kernel/process.c:164]
Allocated by task 54: rxgkverifyresponse() [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155 net/rxrpc/rxgk.c:1274] rxrpcprocessconnection() [net/rxrpc/connevent.c:266 net/rxrpc/connevent.c:364 net/rxrpc/connevent.c:386]
Convert the byte count to be32 units before constructing the parser limit.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31636?
CVE-2026-31636 has a high severity rating due to its potential to cause an out-of-bounds read in the Linux kernel.
How do I fix CVE-2026-31636?
To fix CVE-2026-31636, upgrade your Linux kernel to a version that includes the patch for this vulnerability.
What versions of the Linux kernel are affected by CVE-2026-31636?
CVE-2026-31636 affects multiple versions of the Linux kernel, specifically versions between 6.16.1 and 6.18.23, 6.19, and various release candidates of 7.0.
What are the potential impacts of CVE-2026-31636?
The impacts of CVE-2026-31636 include the possibility of unintended information disclosure or system instability due to the out-of-bounds access.
Is CVE-2026-31636 being actively exploited?
As of now, there is no public indication that CVE-2026-31636 is being actively exploited, but it is recommended to apply patches promptly.