CVE-2026-31635 (GCVE-0-2026-31635)
Vulnerability from cvelistv5
Published
2026-04-24 14:44
Modified
2026-08-05 12:23
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an impossible length and hit BUG_ON(len). Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: RIP: __skb_to_sgvec() [net/core/skbuff.c:5285 (discriminator 1)] Call Trace: skb_to_sgvec() [net/core/skbuff.c:5305] rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81] rxgk_verify_response() [net/rxrpc/rxgk.c:1268] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Reject authenticator lengths that exceed the remaining packet payload.
References
Impacted products
Vendor Product Version
Linux Linux Version: 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a
Version: 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a
Version: 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31635",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-18T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-130",
                "description": "CWE-130 Improper Handling of Length Parameter Inconsistency",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T03:55:26.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/v12-security/pocs/tree/main/dirtydecrypt"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/rxgk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "beee051f259acd286fed64c32c2b31e6f5097eb5",
              "status": "affected",
              "version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a",
              "versionType": "git"
            },
            {
              "lessThan": "e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305",
              "status": "affected",
              "version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a",
              "versionType": "git"
            },
            {
              "lessThan": "a2567217ade970ecc458144b6be469bc015b23e5",
              "status": "affected",
              "version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/rxgk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix oversized RESPONSE authenticator length check\n\nrxgk_verify_response() decodes auth_len from the packet and is supposed\nto verify that it fits in the remaining bytes. The existing check is\ninverted, so oversized RESPONSE authenticators are accepted and passed\nto rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an\nimpossible length and hit BUG_ON(len).\n\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\n\nRIP: __skb_to_sgvec()\n  [net/core/skbuff.c:5285 (discriminator 1)]\nCall Trace:\n skb_to_sgvec() [net/core/skbuff.c:5305]\n rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]\n rxgk_verify_response() [net/rxrpc/rxgk.c:1268]\n rxrpc_process_connection()\n   [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n    net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n   [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nReject authenticator lengths that exceed the remaining packet payload."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - RxRPC packets are received over UDP and the vulnerable RXGK RESPONSE parser is reached from the network receive path on a listening RxRPC service. A remote peer can initiate a service call, receive a challenge, and send the malformed RESPONSE packet.\nAC:L - The trigger is a deterministic oversized authenticator length in an attacker-controlled RESPONSE packet, with no race or hard-to-control timing. A valid RXGK deployment and normal handshake state are prerequisites, but not exploit-complexity conditions beyond the attacker\u2019s packet construction.\nPR:N - The vulnerable code runs during the connection authentication handshake before the RESPONSE authenticator is accepted. No privileges on the vulnerable host are required to send the network packets that reach this path.\nUI:N - No user action is required on the victim once an affected RxRPC service is listening. The attacker can drive the packet exchange directly over the network.\nS:U - The impact is within the kernel/network service security authority of the vulnerable system. There is no guest-to-host, sandbox, or other authority-boundary escape.\nC:N - The bug passes an impossible length to skb_to_sgvec(), which reaches BUG_ON(len), and the investigated path does not expose kernel memory to the attacker. This issue is a crash path, not the separate RESPONSE parser out-of-bounds read bug.\nI:N - The oversized length does not create an attacker-controlled write or control-flow primitive in the investigated path. Execution stops at the skb_to_sgvec() BUG_ON before decrypted authenticator contents are processed.\nA:H - The malformed RESPONSE can hit BUG_ON(len) in __skb_to_sgvec(), causing a kernel oops/panic-class failure. A remote attacker can repeat the handshake and malformed packet to cause denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:59.642Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/beee051f259acd286fed64c32c2b31e6f5097eb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2567217ade970ecc458144b6be469bc015b23e5"
        }
      ],
      "title": "rxrpc: fix oversized RESPONSE authenticator length check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31635",
    "datePublished": "2026-04-24T14:44:49.963Z",
    "dateReserved": "2026-03-09T15:48:24.125Z",
    "dateUpdated": "2026-08-05T12:23:59.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-31635\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-18T13:26:31.187019Z\"}}}], \"references\": [{\"url\": \"https://github.com/v12-security/pocs/tree/main/dirtydecrypt\", \"tags\": [\"exploit\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-130\", \"description\": \"CWE-130 Improper Handling of Length Parameter Inconsistency\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-18T13:26:22.982Z\"}}], \"cna\": {\"title\": \"rxrpc: fix oversized RESPONSE authenticator length check\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a\", \"lessThan\": \"beee051f259acd286fed64c32c2b31e6f5097eb5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a\", \"lessThan\": \"e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a\", \"lessThan\": \"a2567217ade970ecc458144b6be469bc015b23e5\", \"versionType\": \"git\"}], \"programFiles\": [\"net/rxrpc/rxgk.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.18.23\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.19.*\"}, {\"status\": \"unaffected\", \"version\": \"7.0\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/rxrpc/rxgk.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/beee051f259acd286fed64c32c2b31e6f5097eb5\"}, {\"url\": \"https://git.kernel.org/stable/c/e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305\"}, {\"url\": \"https://git.kernel.org/stable/c/a2567217ade970ecc458144b6be469bc015b23e5\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: fix oversized RESPONSE authenticator length check\\n\\nrxgk_verify_response() decodes auth_len from the packet and is supposed\\nto verify that it fits in the remaining bytes. The existing check is\\ninverted, so oversized RESPONSE authenticators are accepted and passed\\nto rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an\\nimpossible length and hit BUG_ON(len).\\n\\nDecoded from the original latest-net reproduction logs with\\nscripts/decode_stacktrace.sh:\\n\\nRIP: __skb_to_sgvec()\\n  [net/core/skbuff.c:5285 (discriminator 1)]\\nCall Trace:\\n skb_to_sgvec() [net/core/skbuff.c:5305]\\n rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]\\n rxgk_verify_response() [net/rxrpc/rxgk.c:1268]\\n rxrpc_process_connection()\\n   [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\\n    net/rxrpc/conn_event.c:386]\\n process_one_work() [kernel/workqueue.c:3281]\\n worker_thread()\\n   [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\\n kthread() [kernel/kthread.c:436]\\n ret_from_fork() [arch/x86/kernel/process.c:164]\\n\\nReject authenticator lengths that exceed the remaining packet payload.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.23\", \"versionStartIncluding\": \"6.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19.13\", \"versionStartIncluding\": \"6.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0\", \"versionStartIncluding\": \"6.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T22:12:37.582Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-31635\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-18T13:28:04.169Z\", \"dateReserved\": \"2026-03-09T15:48:24.125Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-04-24T14:44:49.963Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.