CVE-2026-31630

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31630", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.124Z", "datePublished": "2026-04-24T14:44:46.606Z", "dateUpdated": "2026-10-21T12:39:36.441Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:39:36.441Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: proc: size address buffers for %pISpc output\n\nThe AF_RXRPC procfs helpers format local and remote socket addresses into\nfixed 50-byte stack buffers with \"%pISpc\".\n\nThat is too small for the longest current-tree IPv6-with-port form the\nformatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a\ndotted-quad tail not only for v4mapped addresses, but also for ISATAP\naddresses via ipv6_addr_is_isatap().\n\nAs a result, a case such as\n\n [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nis possible with the current formatter. That is 50 visible characters, so\n51 bytes including the trailing NUL, which does not fit in the existing\nchar[50] buffers used by net/rxrpc/proc.c.\n\nSize the buffers from the formatter's maximum textual form and switch the\ncall sites to scnprintf().\n\nChanges since v1:\n- correct the changelog to cite the actual maximum current-tree case\n explicitly\n- frame the proof around the ISATAP formatting path instead of the earlier\n mapped-v4 example"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The overflowing sprintf is executed when a local process reads the world-readable RXRPC procfs seq files under /proc/net/rxrpc. A remote RXRPC peer can influence stored addresses on a listening service, but cannot directly invoke the proc show path without a local proc read.\nAC:L - No race or hard-to-control timing is required; an attacker can create or cause an RXRPC IPv6 peer/address with the maximal ISATAP-style textual form and read the proc entry. The overflow condition is deterministic once such an address is present.\nPR:L - The proc entries are created mode 0444 and RXRPC socket creation/sendmsg paths do not impose a capability check, so a basic unprivileged local user can reach the vulnerable show functions. This does not require real root or init-namespace administrative privileges.\nUI:N - The attacker can trigger the vulnerable formatting by reading the proc file themselves. No separate victim action is required.\nS:U - The bug corrupts kernel memory within the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is kernel stack memory corruption from an out-of-bounds write in attacker-reachable code. Following the higher-severity rule for memory corruption, successful exploitation could compromise kernel confidentiality.\nI:H - The vulnerable sprintf writes past a fixed stack buffer, giving an out-of-bounds kernel stack write. Under the required scoring guidance, out-of-bounds writes are treated as high integrity impact due to potential control-flow or kernel state corruption.\nA:H - Even if not shaped into code execution, the stack corruption can produce an oops, panic, or other kernel crash. The attacker can retrigger it repeatedly by reading the affected proc entries while the crafted address object exists."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/proc.c"], "versions": [{"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "386c86412608d3449006a318a662cbcd6ca1f668", "status": "affected", "versionType": "git"}, {"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "235b2115de892eab2e107a42efa7a4347baaa80b", "status": "affected", "versionType": "git"}, {"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "625af53a1564e31bb2df9adc3739df46137f46c1", "status": "affected", "versionType": "git"}, {"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "808a34cdbe8ce336c202d8ea6d5e48496764dc37", "status": "affected", "versionType": "git"}, {"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "a6042b8066b24dbcc7945616a157d4d43e463668", "status": "affected", "versionType": "git"}, {"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "db297c78ce537c9ac96f0eda9b25ad72c8caefa9", "status": "affected", "versionType": "git"}, {"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "10ebed83f9f6414af4e85bc85ffaeda7effdd874", "status": "affected", "versionType": "git"}, {"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "a44ce6aa2efb61fe44f2cfab72bb01544bbca272", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/proc.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.23", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.13", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.18.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.19.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/386c86412608d3449006a318a662cbcd6ca1f668"}, {"url": "https://git.kernel.org/stable/c/235b2115de892eab2e107a42efa7a4347baaa80b"}, {"url": "https://git.kernel.org/stable/c/625af53a1564e31bb2df9adc3739df46137f46c1"}, {"url": "https://git.kernel.org/stable/c/808a34cdbe8ce336c202d8ea6d5e48496764dc37"}, {"url": "https://git.kernel.org/stable/c/a6042b8066b24dbcc7945616a157d4d43e463668"}, {"url": "https://git.kernel.org/stable/c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9"}, {"url": "https://git.kernel.org/stable/c/10ebed83f9f6414af4e85bc85ffaeda7effdd874"}, {"url": "https://git.kernel.org/stable/c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272"}], "title": "rxrpc: proc: size address buffers for %pISpc output", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:22.345Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31630", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:11:18.108954Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:56:00.606Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:22.345Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31630", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:11:18.108954Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:11:18.671Z"}}], "cna": {"title": "rxrpc: proc: size address buffers for %pISpc output", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The overflowing sprintf is executed when a local process reads the world-readable RXRPC procfs seq files under /proc/net/rxrpc. A remote RXRPC peer can influence stored addresses on a listening service, but cannot directly invoke the proc show path without a local proc read.\nAC:L - No race or hard-to-control timing is required; an attacker can create or cause an RXRPC IPv6 peer/address with the maximal ISATAP-style textual form and read the proc entry. The overflow condition is deterministic once such an address is present.\nPR:L - The proc entries are created mode 0444 and RXRPC socket creation/sendmsg paths do not impose a capability check, so a basic unprivileged local user can reach the vulnerable show functions. This does not require real root or init-namespace administrative privileges.\nUI:N - The attacker can trigger the vulnerable formatting by reading the proc file themselves. No separate victim action is required.\nS:U - The bug corrupts kernel memory within the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is kernel stack memory corruption from an out-of-bounds write in attacker-reachable code. Following the higher-severity rule for memory corruption, successful exploitation could compromise kernel confidentiality.\nI:H - The vulnerable sprintf writes past a fixed stack buffer, giving an out-of-bounds kernel stack write. Under the required scoring guidance, out-of-bounds writes are treated as high integrity impact due to potential control-flow or kernel state corruption.\nA:H - Even if not shaped into code execution, the stack corruption can produce an oops, panic, or other kernel crash. The attacker can retrigger it repeatedly by reading the affected proc entries while the crafted address object exists."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "386c86412608d3449006a318a662cbcd6ca1f668", "versionType": "git"}, {"status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "235b2115de892eab2e107a42efa7a4347baaa80b", "versionType": "git"}, {"status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "625af53a1564e31bb2df9adc3739df46137f46c1", "versionType": "git"}, {"status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "808a34cdbe8ce336c202d8ea6d5e48496764dc37", "versionType": "git"}, {"status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "a6042b8066b24dbcc7945616a157d4d43e463668", "versionType": "git"}, {"status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "db297c78ce537c9ac96f0eda9b25ad72c8caefa9", "versionType": "git"}, {"status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "10ebed83f9f6414af4e85bc85ffaeda7effdd874", "versionType": "git"}, {"status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "lessThan": "a44ce6aa2efb61fe44f2cfab72bb01544bbca272", "versionType": "git"}], "programFiles": ["net/rxrpc/proc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"status": "unaffected", "version": "0", "lessThan": "4.9", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.23", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.13", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/rxrpc/proc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/386c86412608d3449006a318a662cbcd6ca1f668"}, {"url": "https://git.kernel.org/stable/c/235b2115de892eab2e107a42efa7a4347baaa80b"}, {"url": "https://git.kernel.org/stable/c/625af53a1564e31bb2df9adc3739df46137f46c1"}, {"url": "https://git.kernel.org/stable/c/808a34cdbe8ce336c202d8ea6d5e48496764dc37"}, {"url": "https://git.kernel.org/stable/c/a6042b8066b24dbcc7945616a157d4d43e463668"}, {"url": "https://git.kernel.org/stable/c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9"}, {"url": "https://git.kernel.org/stable/c/10ebed83f9f6414af4e85bc85ffaeda7effdd874"}, {"url": "https://git.kernel.org/stable/c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: proc: size address buffers for %pISpc output\n\nThe AF_RXRPC procfs helpers format local and remote socket addresses into\nfixed 50-byte stack buffers with \"%pISpc\".\n\nThat is too small for the longest current-tree IPv6-with-port form the\nformatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a\ndotted-quad tail not only for v4mapped addresses, but also for ISATAP\naddresses via ipv6_addr_is_isatap().\n\nAs a result, a case such as\n\n [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nis possible with the current formatter. That is 50 visible characters, so\n51 bytes including the trailing NUL, which does not fit in the existing\nchar[50] buffers used by net/rxrpc/proc.c.\n\nSize the buffers from the formatter's maximum textual form and switch the\ncall sites to scnprintf().\n\nChanges since v1:\n- correct the changelog to cite the actual maximum current-tree case\n explicitly\n- frame the proof around the ISATAP formatting path instead of the earlier\n mapped-v4 example"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.23", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.13", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "4.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:39:36.441Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31630", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:39:36.441Z", "dateReserved": "2026-03-09T15:48:24.124Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-24T14:44:46.606Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rxrpc/proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "386c86412608d3449006a318a662cbcd6ca1f668", "status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "versionType": "git"}, {"lessThan": "235b2115de892eab2e107a42efa7a4347baaa80b", "status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "versionType": "git"}, {"lessThan": "625af53a1564e31bb2df9adc3739df46137f46c1", "status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "versionType": "git"}, {"lessThan": "808a34cdbe8ce336c202d8ea6d5e48496764dc37", "status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "versionType": "git"}, {"lessThan": "a6042b8066b24dbcc7945616a157d4d43e463668", "status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "versionType": "git"}, {"lessThan": "db297c78ce537c9ac96f0eda9b25ad72c8caefa9", "status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "versionType": "git"}, {"lessThan": "10ebed83f9f6414af4e85bc85ffaeda7effdd874", "status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "versionType": "git"}, {"lessThan": "a44ce6aa2efb61fe44f2cfab72bb01544bbca272", "status": "affected", "version": "75b54cb57ca34cbe7a87c6ac757c55360a624590", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rxrpc/proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.23", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "59855615-6720-4D3F-83EB-B5CCFD90FBD3", "versionEndExcluding": "6.18.23", "versionStartIncluding": "4.9.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1490EF9B-9080-481C-8D22-1306AAE664E4", "versionEndExcluding": "6.19.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.9:-:*:*:*:*:*:*", "matchCriteriaId": "592761F7-6672-484E-8490-1187F4CDD13E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: proc: size address buffers for %pISpc output\n\nThe AF_RXRPC procfs helpers format local and remote socket addresses into\nfixed 50-byte stack buffers with \"%pISpc\".\n\nThat is too small for the longest current-tree IPv6-with-port form the\nformatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a\ndotted-quad tail not only for v4mapped addresses, but also for ISATAP\naddresses via ipv6_addr_is_isatap().\n\nAs a result, a case such as\n\n [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nis possible with the current formatter. That is 50 visible characters, so\n51 bytes including the trailing NUL, which does not fit in the existing\nchar[50] buffers used by net/rxrpc/proc.c.\n\nSize the buffers from the formatter's maximum textual form and switch the\ncall sites to scnprintf().\n\nChanges since v1:\n- correct the changelog to cite the actual maximum current-tree case\n explicitly\n- frame the proof around the ISATAP formatting path instead of the earlier\n mapped-v4 example"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: proc: dimensionar los b\u00faferes de direcci\u00f3n para la salida %pISpc\n\nLos ayudantes de procfs de AF_RXRPC formatean las direcciones de socket locales y remotas en b\u00faferes de pila fijos de 50 bytes con \u2019%pISpc\u2019.\n\nEso es demasiado peque\u00f1o para la forma m\u00e1s larga de IPv6 con puerto del \u00e1rbol actual que el formateador puede producir. En lib/vsprintf.c, la ruta IPv6 comprimida utiliza una cola de cu\u00e1druple punteado no solo para direcciones mapeadas a v4, sino tambi\u00e9n para direcciones ISATAP a trav\u00e9s de ipv6_addr_is_isatap().\n\nComo resultado, un caso como\n\n [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nes posible con el formateador actual. Eso son 50 caracteres visibles, por lo tanto, 51 bytes incluyendo el NUL final, lo cual no cabe en los b\u00faferes char[50] existentes utilizados por net/rxrpc/proc.c.\n\nDimensionar los b\u00faferes a partir de la forma textual m\u00e1xima del formateador y cambiar los sitios de llamada a scnprintf().\n\nCambios desde la v1:\n- corregir el registro de cambios para citar expl\u00edcitamente el caso m\u00e1ximo real del \u00e1rbol actual\n- enmarcar la prueba en torno a la ruta de formateo ISATAP en lugar del ejemplo anterior de v4 mapeado"}], "id": "CVE-2026-31630", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31630", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:11:18.108954Z", "version": "2.0.3"}}]}, "published": "2026-04-24T15:16:42.323", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/10ebed83f9f6414af4e85bc85ffaeda7effdd874"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/235b2115de892eab2e107a42efa7a4347baaa80b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/386c86412608d3449006a318a662cbcd6ca1f668"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/625af53a1564e31bb2df9adc3739df46137f46c1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/808a34cdbe8ce336c202d8ea6d5e48496764dc37"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a6042b8066b24dbcc7945616a157d4d43e463668"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-121"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: rxrpc: proc: size address buffers for %pISpc output", "id": "2461545", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461545"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-131", "details": ["A flaw was found in the Linux kernel, specifically within the rxrpc component. The AF_RXRPC procfs helpers use fixed-size buffers to format local and remote socket addresses. When processing certain IPv6 addresses with ports, the formatted string can exceed the buffer's capacity, leading to a buffer overflow. This memory corruption vulnerability can cause system instability or a denial of service (DoS)."], "name": "CVE-2026-31630", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31630\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31630\nhttps://lore.kernel.org/linux-cve-announce/2026042453-CVE-2026-31630-4218@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[75b54cb57ca34cbe7a87c6ac757c55360a624590,db297c78ce537c9ac96f0eda9b25ad72c8caefa9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[75b54cb57ca34cbe7a87c6ac757c55360a624590,10ebed83f9f6414af4e85bc85ffaeda7effdd874)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[75b54cb57ca34cbe7a87c6ac757c55360a624590,a44ce6aa2efb61fe44f2cfab72bb01544bbca272)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.23,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.13,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-27T18:45:11.325592+00:00", "updated": "2026-10-23T08:45:16.401329+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}