CVE-2026-31636

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31636", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.125Z", "datePublished": "2026-04-24T14:44:50.637Z", "dateUpdated": "2026-08-05T12:24:00.729Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:00.729Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix RESPONSE authenticator parser OOB read\n\nrxgk_verify_authenticator() copies auth_len bytes into a temporary\nbuffer and then passes p + auth_len as the parser limit to\nrxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the\nparser end pointer by a factor of four and lets malformed RESPONSE\nauthenticators read past the kmalloc() buffer.\n\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\n\nBUG: KASAN: slab-out-of-bounds in rxgk_verify_response()\nCall Trace:\n dump_stack_lvl() [lib/dump_stack.c:123]\n print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482]\n kasan_report() [mm/kasan/report.c:597]\n rxgk_verify_response()\n [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nAllocated by task 54:\n rxgk_verify_response()\n [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n\nConvert the byte count to __be32 units before constructing the parser\nlimit."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable rxgk RESPONSE authenticator parser is reached by network RxRPC packets delivered over UDP to an AF_RXRPC service connection.\nAC:L - There is no race or condition outside the attacker's control; a peer can initiate the handshake, receive the challenge, and send malformed RESPONSE data to drive the parser.\nPR:N - The packet is processed while the server connection is still in RXRPC_CONN_SERVICE_CHALLENGING, before the connection is accepted as authenticated.\nUI:N - No victim user action is required beyond the RxRPC service being reachable and processing incoming network traffic.\nS:U - The impact remains within the kernel/RxRPC service security authority and does not cross a VM, IOMMU, or comparable scope boundary.\nC:H - The byte-count versus __be32 pointer arithmetic bug lets the parser read well beyond the kmalloc authenticator buffer at attacker-influenced offsets, and the overread is not strictly bounded to a few bytes.\nI:N - The flaw is an out-of-bounds read and does not provide an arbitrary write or control-flow modification primitive.\nA:H - The fix commit documents a KASAN slab-out-of-bounds report in the RESPONSE processing path, and malformed network responses can repeatedly trigger kernel fault/panic behavior."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/rxgk.c"], "versions": [{"version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a", "lessThan": "7875f3d9777bd4e9892c4db830571ab8ac2044c0", "status": "affected", "versionType": "git"}, {"version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a", "lessThan": "20a188775a9a9982d1987e12660d9b44b40a6c99", "status": "affected", "versionType": "git"}, {"version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a", "lessThan": "3e3138007887504ee9206d0bfb5acb062c600025", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/rxgk.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.23", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.13", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7875f3d9777bd4e9892c4db830571ab8ac2044c0"}, {"url": "https://git.kernel.org/stable/c/20a188775a9a9982d1987e12660d9b44b40a6c99"}, {"url": "https://git.kernel.org/stable/c/3e3138007887504ee9206d0bfb5acb062c600025"}], "title": "rxrpc: fix RESPONSE authenticator parser OOB read", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rxrpc/rxgk.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7875f3d9777bd4e9892c4db830571ab8ac2044c0", "status": "affected", "version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a", "versionType": "git"}, {"lessThan": "20a188775a9a9982d1987e12660d9b44b40a6c99", "status": "affected", "version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a", "versionType": "git"}, {"lessThan": "3e3138007887504ee9206d0bfb5acb062c600025", "status": "affected", "version": "9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rxrpc/rxgk.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.23", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EAE31F43-AAC5-4801-B2B2-119D62A532A2", "versionEndExcluding": "6.18.23", "versionStartIncluding": "6.16.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1490EF9B-9080-481C-8D22-1306AAE664E4", "versionEndExcluding": "6.19.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*", "matchCriteriaId": "6238B17D-C12B-458F-A138-97039BFC4595", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix RESPONSE authenticator parser OOB read\n\nrxgk_verify_authenticator() copies auth_len bytes into a temporary\nbuffer and then passes p + auth_len as the parser limit to\nrxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the\nparser end pointer by a factor of four and lets malformed RESPONSE\nauthenticators read past the kmalloc() buffer.\n\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\n\nBUG: KASAN: slab-out-of-bounds in rxgk_verify_response()\nCall Trace:\n dump_stack_lvl() [lib/dump_stack.c:123]\n print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482]\n kasan_report() [mm/kasan/report.c:597]\n rxgk_verify_response()\n [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nAllocated by task 54:\n rxgk_verify_response()\n [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n\nConvert the byte count to __be32 units before constructing the parser\nlimit."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: correcci\u00f3n de lectura fuera de l\u00edmites del analizador de autenticador RESPONSE\n\nrxgk_verify_authenticator() copia auth_len bytes en un b\u00fafer temporal y luego pasa p + auth_len como el l\u00edmite del analizador a rxgk_do_verify_authenticator(). Dado que p es un __be32 *, eso infla el puntero de fin del analizador por un factor de cuatro y permite que los autenticadores RESPONSE malformados lean m\u00e1s all\u00e1 del b\u00fafer de kmalloc().\n\nDecodificado de los registros de reproducci\u00f3n originales de latest-net con scripts/decode_stacktrace.sh:\n\nERROR: KASAN: slab-fuera-de-l\u00edmites en rxgk_verify_response()\nTraza de Llamada:\n dump_stack_lvl() [lib/dump_stack.c:123]\n print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482]\n kasan_report() [mm/kasan/report.c:597]\n rxgk_verify_response()\n [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nAsignado por tarea 54:\n rxgk_verify_response()\n [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n\nConvertir el recuento de bytes a unidades __be32 antes de construir el l\u00edmite del analizador."}], "id": "CVE-2026-31636", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-04-24T15:16:42.920", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/20a188775a9a9982d1987e12660d9b44b40a6c99"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3e3138007887504ee9206d0bfb5acb062c600025"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7875f3d9777bd4e9892c4db830571ab8ac2044c0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rxrpc: fix RESPONSE authenticator parser OOB read", "id": "2461510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461510"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nrxrpc: fix RESPONSE authenticator parser OOB read\nrxgk_verify_authenticator() copies auth_len bytes into a temporary\nbuffer and then passes p + auth_len as the parser limit to\nrxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the\nparser end pointer by a factor of four and lets malformed RESPONSE\nauthenticators read past the kmalloc() buffer.\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\nBUG: KASAN: slab-out-of-bounds in rxgk_verify_response()\nCall Trace:\ndump_stack_lvl() [lib/dump_stack.c:123]\nprint_report() [mm/kasan/report.c:379 mm/kasan/report.c:482]\nkasan_report() [mm/kasan/report.c:597]\nrxgk_verify_response()\n[net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167\nnet/rxrpc/rxgk.c:1274]\nrxrpc_process_connection()\n[net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\nnet/rxrpc/conn_event.c:386]\nprocess_one_work() [kernel/workqueue.c:3281]\nworker_thread()\n[kernel/workqueue.c:3353 kernel/workqueue.c:3440]\nkthread() [kernel/kthread.c:436]\nret_from_fork() [arch/x86/kernel/process.c:164]\nAllocated by task 54:\nrxgk_verify_response()\n[include/linux/slab.h:954 net/rxrpc/rxgk.c:1155\nnet/rxrpc/rxgk.c:1274]\nrxrpc_process_connection()\n[net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\nnet/rxrpc/conn_event.c:386]\nConvert the byte count to __be32 units before constructing the parser\nlimit.", "A flaw was found in the Linux kernel's rxrpc subsystem. A remote attacker could send a specially crafted rxrpc RESPONSE authenticator that, due to an incorrect parser limit calculation in the rxgk_verify_authenticator() function, leads to a slab-out-of-bounds read. This memory corruption vulnerability could result in information disclosure or a denial of service."], "name": "CVE-2026-31636", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31636\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31636\nhttps://lore.kernel.org/linux-cve-announce/2026042455-CVE-2026-31636-2951@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a,7875f3d9777bd4e9892c4db830571ab8ac2044c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a,20a188775a9a9982d1987e12660d9b44b40a6c99)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a,3e3138007887504ee9206d0bfb5acb062c600025)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.23,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.13,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T20:06:12.318436+00:00", "value": {"mitigation_remediation": ["Apply a kernel version that includes the patched rxrpc response authenticator parser, such as any release beyond the 7.0 RC7 commit or an updated distribution kernel.", "Disable or block rxrpc traffic on affected hosts as a temporary workaround: block the rxrpc port or disable the protocol stack entirely if it is not required for your environment.", "Continuously monitor system logs for KASAN or kernel out\u2011of\u2011bounds read messages and investigate promptly."], "summary": {"action": "Immediate Patch", "impact": "Out-of-bounds read (CWE-125) in the Linux rxrpc authenticator parser, enabling kernel memory disclosure."}, "threat_synthesis": {"affected_systems": "All Linux kernel releases before the commit that fixed the bug, specifically kernel 6.16 and all 7.0 release candidates (rc1 through rc7) as well as earlier kernel revisions. The issue is present in the mainline Linux kernel and is not limited to a specific distribution.", "description_and_impact": "The vulnerability occurs in the Linux kernel\u2019s rxrpc implementation where the response authenticator parser incorrectly calculates a parser limit, causing an out\u2011of\u2011bounds read of a temporary buffer when a malformed RESPONSE packet is processed. This bug can leak contents of kernel memory and may serve as a stepping stone for further exploitation. This weakness is identified as CWE-125.", "risk_and_exploitability": "The CVSS score of 9.1 combined with an EPSS score of less than 1% indicates a highly severe weakness that is currently considered unlikely to be exploited at scale. The vulnerability can be triggered via a malicious rxrpc packet sent over a network connection; it does not require local privilege escalation. The bug is not listed in the CISA KEV catalog, but its severity warrants immediate mitigations. It is classified as CWE-125."}}}}, "created": "2026-04-27T18:45:11.323377+00:00", "updated": "2026-04-28T20:15:26.808726+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}