CVE-2026-31635 rxrpc: fix oversized RESPONSE authenticator length check
An attacker can cause a kernel crash by sending oversized rxrpc RESPONSE authenticators due to an inverted length check.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31635?
CVE-2026-31635 is a high-severity vulnerability in Linux kernel, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: fix oversized RESPONSE authenticator length check
rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an impossible length and hit BUG_ON(len).
Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh:
RIP: __skb_to_sgvec() [net/core/skbuff.c:5285 (discriminator 1)] Call Trace: skb_to_sgvec() [net/core/skbuff.c:5305] rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81] rxgk_verify_response() [net/rxrpc/rxgk.c:1268] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164]
Reject authenticator lengths that exceed the remaining packet payload.
Weakness: CWE-130
Which versions are affected by CVE-2026-31635?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31635?
Apply the vendor's patch.
Is CVE-2026-31635 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31635 exists.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31635, DEBIAN-CVE-2026-31635, GHSA-f5xm-f2m7-vrg6, UBUNTU-CVE-2026-31635.