CVE-2026-31696 rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
An unprivileged user can trigger a kernel warning and potential denial of service by providing an invalid ticket length in the rxrpc subsystem.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31696?
CVE-2026-31696 is a high-severity vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
In rxrpc_preparse(), there are two paths for parsing key payloads: the XDR path (for large payloads) and the non-XDR path (for payloads <= 28 bytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly validates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR path fails to do so.
This allows an unprivileged user to provide a very large ticket length. When this key is later read via rxrpc_read(), the total token size (toksize) calculation results in a value that exceeds AFSTOKEN_LENGTH_MAX, triggering a WARN_ON().
[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]
Fix this by adding a check in the non-XDR parsing path of rxrpc_preparse() to ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX, bringing it into parity with the XDR parsing logic.
Weakness: CWE-787
Which versions are affected by CVE-2026-31696?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31696?
Apply the vendor's patch.
Is CVE-2026-31696 being exploited?
There is no known exploitation of CVE-2026-31696 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-85433, BELL-CVE-2026-31696, DEBIAN-CVE-2026-31696, GHSA-jrvq-m3v6-8wm9, ROOT-OS-DEBIAN-11-CVE-2026-31696, ROOT-OS-DEBIAN-12-CVE-2026-31696 and 3 more.