CVE-2026-31696: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
In rxrpcpreparse(), there are two paths for parsing key payloads: the XDR path (for large payloads) and the non-XDR path (for payloads <= 28 bytes). While the XDR path (rxrpcpreparsexdrrxkad()) correctly validates the ticket length against AFSTOKENRKTIXMAX, the non-XDR path fails to do so.
This allows an unprivileged user to provide a very large ticket length. When this key is later read via rxrpcread(), the total token size (toksize) calculation results in a value that exceeds AFSTOKENLENGTHMAX, triggering a WARNON().
[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpcread+0x109/0x5c0 [rxrpc]
Fix this by adding a check in the non-XDR parsing path of rxrpcpreparse() to ensure the ticket length does not exceed AFSTOKENRKTIXMAX, bringing it into parity with the XDR parsing logic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the non-XDR parsing path of rxrpc_preparse(), validate that the ticket length does not exceed AFSTOKEN_RK_TIX_MAX, matching the validation performed by rxrpc_preparse_xdr_rxkad().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31696?
CVE-2026-31696 is classified as a medium severity vulnerability due to the potential for undetected ticket length issues.
How do I fix CVE-2026-31696?
Fixing CVE-2026-31696 involves updating the Linux kernel to a version where the vulnerability has been addressed.
What systems are affected by CVE-2026-31696?
CVE-2026-31696 affects the Linux kernel, specifically the rxrpc module during key payload parsing.
What are the risks associated with CVE-2026-31696?
The risks include potential security weaknesses related to validation issues, which could be exploited by an attacker.
Is there a patch available for CVE-2026-31696?
Yes, a patch is available in updated versions of the Linux kernel that address the vulnerability.