What is CVE-2026-31635?
In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an impossible length and hit BUG_ON(len). Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: RIP: __skb_to_sgvec() [net/core/skbuff.c:5285 (discriminator 1)] Call Trace: skb_to_sgvec() [net/core/skbuff.c:5305] rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81] rxgk_verify_response() [net/rxrpc/rxgk.c:1268] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Reject authenticator lengths that exceed the remaining packet payload.
Timeline
- 2026-04-24Published to the U.S. National Vulnerability Database (NVD)
- 2026-05-20First covered in a defend.network daily briefing
- 2026-06-17NVD record last updated
Affected product
Linux Kernel
References
Referenced in our briefings & reports
Related vulnerabilities
- CVE-2026-123218 – IBM Aspera Faspex (same product)
- CVE-2026-102489 – Zammad GmbH Zammad (same product)
- CVE-2026-102490 – Zammad GmbH Zammad (same product)
- CVE-2026-87886 – Acronis Backup (same product)
- CVE-2026-48449 – Adobe Campaign (same product)
- CVE-2026-53359 – Linux Kernel (same product)
Browse all tracked CVEs in the defend.network CVE database →