CVE-2026-31637: rxrpc: reject undecryptable rxkad response tickets
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: reject undecryptable rxkad response tickets
rxkaddecryptticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether cryptoskcipherdecrypt() succeeded.
A malformed RESPONSE can therefore use a non-block-aligned ticket length, make the decrypt operation fail, and still drive the ticket parser with attacker-controlled bytes.
Check the decrypt result and abort the connection with RXKADBADTICKET when ticket decryption fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.12.86-1Fixed in 6.12.95-1Fixed in 7.0.13-1Fixed in 7.1.3-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.176-1~deb11u1 - Configuration
Update the kernel so rxkad_decrypt_ticket() checks the decrypt result (crypto_skcipher_decrypt) and, if ticket decryption fails, rejects the packet by aborting the connection with RXKADBADTICKET instead of parsing attacker-controlled plaintext.
Linux kernel (rxrpc / RXKAD response tickets) rxkad_decrypt_ticket() decrypt-result checking = abort connection with RXKADBADTICKET when crypto_skcipher_decrypt() fails
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31637?
CVE-2026-31637 is considered a high-severity vulnerability that could lead to security risks in the Linux kernel.
How do I fix CVE-2026-31637?
To fix CVE-2026-31637, upgrade to a patched version of the Linux kernel that addresses the vulnerabilities in rxrpc.
What systems are affected by CVE-2026-31637?
CVE-2026-31637 affects multiple versions of the Linux kernel, particularly those between 2.6.22.1 and 7.0-rc7.
What type of vulnerability is CVE-2026-31637?
CVE-2026-31637 is a cryptographic vulnerability related to the handling of undecodable rxkad response tickets in the Linux kernel.
What happens if CVE-2026-31637 is exploited?
If exploited, CVE-2026-31637 could lead to unauthorized access or potentially allow an attacker to manipulate communications.