CVE-2026-31641

Advisory lineage Upstream: 0 Downstream: 3
Analyzed
Published: 24 Apr 2026, 14:44
Last modified:15 Jul 2026, 01:09

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.8 HIGH
v3.1 (cve.org)
EPSS Score
0.14% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

24 Apr 2026, 14:44
Published
Vulnerability first disclosed
15 Jul 2026, 01:09
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length from the XDR token as u32 values and passes each through round_up(x, 4) before using the rounded value for validation and allocation. When the raw length is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and kzalloc both use 0 while the subsequent memcpy still copies the original ~4 GiB value, producing a heap buffer overflow reachable from an unprivileged add_key() call. Fix this by: (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX. (2) Sizing the flexible-array allocation from the validated raw key length via struct_size_t() instead of the rounded value. (3) Caching the raw lengths so that the later field assignments and memcpy calls do not re-read from the token, eliminating a class of TOCTOU re-parse. The control path (valid token with lengths within bounds) is unaffected.

CVSS Metrics

  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.14%• Percentile: 4%

Techniques & Countermeasures

  • CWE-125•Out-of-bounds Read

    The product reads data past the end, or before the beginning, of the intended buffer.

  • CWE-190•Integer Overflow or Wraparound

    The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Affected Systems

  • linux•linux

    ≥ 0ca100ff4df64f5d0f6c1dd5080c3e096786bea6, < 3e04596cba8a86cbff9c3f4bf0a524a3a488773c | ≥ 0ca100ff4df64f5d0f6c1dd5080c3e096786bea6, < 49875b360c2b83a3c226e189c502e501d83e6445 | ≥ 0ca100ff4df64f5d0f6c1dd5080c3e096786bea6, < d179a868dd755b0cfcf7582e00943d702b9943b8 | 6.16

  • linux•linux kernel

    ≥ 6.16.1, < 6.18.23 | ≥ 6.19, < 6.19.13 | 6.16 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6 | 7.0:rc7

References (7)