LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31636: rxrpc: fix RESPONSE authenticator parser OOB read

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator() copies auth_len bytes into a temporary buffer and then passes p + auth_len as the parser limit to rxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the parser end pointer by a factor of four and lets malformed RESPONSE authenticators read past the kmalloc() buffer. Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: BUG: KASAN: slab-out-of-bounds in rxgk_verify_response() Call Trace: dump_stack_lvl() [lib/dump_stack.c:123] print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482] kasan_report() [mm/kasan/report.c:597] rxgk_verify_response() [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167 net/rxrpc/rxgk.c:1274] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Allocated by task 54: rxgk_verify_response() [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155 net/rxrpc/rxgk.c:1274] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] Convert the byte count to __be32 units before constructing the parser limit.

CriticalCVSS 9.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A malformed Linux RxRPC RXGK RESPONSE authenticator can make the kernel read beyond an allocated buffer. The supplied CVSS rates this critical because a network-reachable, unauthenticated attacker may cause service disruption or expose memory. The sources do not establish real-world exploitation.

Executive priority

Treat as an urgent kernel remediation item for systems with reachable RxRPC/RXGK functionality. First establish actual feature exposure and vendor patch status, then patch exposed systems promptly. The critical score warrants attention, but the absence of documented active exploitation should prevent unsupported claims of an ongoing campaign.

Technical view

rxgk_verify_authenticator() treats an authentication byte length as a count of 32-bit words when constructing the parser limit. This expands the permitted range fourfold, allowing malformed RESPONSE authenticators to trigger a heap out-of-bounds read in rxgk_verify_response(). KASAN confirmed the flaw. The supplied vector indicates confidentiality and availability impact, but no integrity impact.

Likely exposure

Exposure is limited to Linux systems running an affected kernel where the vulnerable RxRPC/RXGK processing path is present and reachable. The supplied version data is not sufficiently clear for reliable version-only decisions. Systems not using this functionality may have lower practical exposure, but configuration and vendor backport status require verification.

Exploitation context

The supplied CVSS describes network-based, low-complexity exploitation requiring neither privileges nor user interaction. However, no exploit evidence is provided, and the CVE is not identified as being in KEV. Treat exploitation status as unconfirmed rather than active.

Researcher notes

The defect is an end-pointer unit mismatch: auth_len is measured in bytes while p is a __be32 pointer. The correction converts the length to 32-bit units before defining the parser boundary. Available evidence demonstrates an out-of-bounds read under KASAN; it does not independently demonstrate reliable memory disclosure, remote code execution, or exploitation in production.

Mitigation direction

  • Install a distribution-supported kernel containing the cited upstream fix or an equivalent vendor backport.
  • Confirm remediation using the distribution vendor's advisory and package changelog.
  • Prioritize internet-facing or untrusted-network systems that expose the affected RxRPC/RXGK path.
  • If patching is delayed, consult vendor guidance for supported exposure-reduction measures.

Validation and detection

  • Inventory Linux kernel versions and determine whether RxRPC/RXGK functionality is present and reachable.
  • Verify the installed kernel contains a cited fix commit or documented equivalent backport.
  • Review kernel logs for KASAN slab-out-of-bounds reports involving rxgk_verify_response().
  • Reboot into the corrected kernel and confirm the running version, not merely the installed package.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31636 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.1CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H3.95.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.1Critical
CVSS 3.1 vector shape for CVE-2026-31636Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a, 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a, 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54aunaffected
LinuxLinux6.16, 0, 6.18.23, 6.19.13, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.