CVE-2026-31630 rxrpc: proc: size address buffers for %pISpc output
A stack buffer overflow in the Linux kernel's rxrpc procfs helpers allows attackers to potentially execute code or cause a denial of service via crafted IPv6 addresses.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31630?
CVE-2026-31630 is a high-severity memory corruption vulnerability in Linux kernel, published on 24 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: proc: size address buffers for %pISpc output
The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc".
That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap().
As a result, a case such as
[ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535
is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c.
Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf().
Changes since v1: - correct the changelog to cite the actual maximum current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example
Weakness: CWE-121
Which versions are affected by CVE-2026-31630?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31630?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-31630 being exploited?
There is no known exploitation of CVE-2026-31630 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83825, BELL-CVE-2026-31630, DEBIAN-CVE-2026-31630, GHSA-9g7x-mw42-qjmh, ROOT-OS-DEBIAN-11-CVE-2026-31630, ROOT-OS-DEBIAN-12-CVE-2026-31630 and 4 more.