CVE-2026-31696
Buffer Overflow in Linux Kernel rxrpc
Publication date: 2026-05-01
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.7 (inc) to 6.12.84 (exc) |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.25 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 7.0.2 (exc) |
| linux | linux_kernel | From 3.17 (inc) to 6.6.136 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's rxrpc component, specifically in the function rxrpc_preparse(). There are two paths for parsing key payloads: the XDR path for large payloads and the non-XDR path for smaller payloads (28 bytes or less). While the XDR path correctly validates the ticket length, the non-XDR path does not. This allows an unprivileged user to provide an excessively large ticket length, which later causes a calculation overflow and triggers a warning in the kernel.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability triggers a kernel warning when exploited, specifically a WARN_ON() in the rxrpc_read() function due to an invalid ticket length exceeding AFSTOKEN_LENGTH_MAX.
To detect this vulnerability on your system, you can monitor your kernel logs for warnings related to rxrpc_read and ticket length issues.
- Use the command: dmesg | grep 'rxrpc_read' to check for relevant kernel warnings.
- Alternatively, check system logs with: journalctl -k | grep 'rxrpc_read'
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by adding validation in the non-XDR parsing path to ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX.
Immediate mitigation steps include updating your Linux kernel to a version that contains this fix.
Until the update is applied, monitor kernel logs for warnings indicating exploitation attempts and restrict unprivileged user access to the rxrpc subsystem if possible.
How can this vulnerability impact me? :
The vulnerability allows an unprivileged user to supply a very large ticket length that is not properly validated. This can lead to a kernel warning (WARN_ON()) due to an overflow in token size calculation. While the description does not explicitly mention exploitation beyond triggering warnings, such kernel warnings can potentially lead to system instability or denial of service conditions.