CVE-2026-31641

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31641", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.126Z", "datePublished": "2026-04-24T14:44:56.204Z", "dateUpdated": "2026-08-20T12:31:55.191Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:05.369Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix RxGK token loading to check bounds\n\nrxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length\nfrom the XDR token as u32 values and passes each through round_up(x, 4)\nbefore using the rounded value for validation and allocation. When the raw\nlength is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and\nkzalloc both use 0 while the subsequent memcpy still copies the original\n~4 GiB value, producing a heap buffer overflow reachable from an\nunprivileged add_key() call.\n\nFix this by:\n\n (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket\n lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with\n the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX.\n\n (2) Sizing the flexible-array allocation from the validated raw key\n length via struct_size_t() instead of the rounded value.\n\n (3) Caching the raw lengths so that the later field assignments and\n memcpy calls do not re-read from the token, eliminating a class of\n TOCTOU re-parse.\n\nThe control path (valid token with lengths within bounds) is unaffected."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable RxGK token parser is reachable through the local `add_key(\"rxrpc\", ...)` syscall with an attacker-supplied XDR payload. The network RxGK response path builds bounded lengths from packet data and does not allow the near-4GiB raw length values needed for this overflow.\nAC:L - An attacker can deterministically craft a small XDR token whose raw key or ticket length is >= 0xfffffffd so `round_up()` wraps before validation/allocation. No race or victim-controlled timing is required.\nPR:L - The fix commit explicitly describes the bug as reachable from an unprivileged `add_key()` call. The only practical gate is write access to a user-writable keyring, which a normal local user can have without real root capabilities.\nUI:N - Exploitation only requires the attacker to invoke the syscall with a crafted payload. No separate victim action is needed.\nS:U - The vulnerable code runs in the kernel and impacts kernel memory within the same security authority. This is a standard local kernel compromise/DoS scenario rather than a defined cross-scope boundary escape.\nC:H - The bug is a heap memory corruption caused by copying a near-4GiB attacker-selected length from a small token into an undersized `rxgk_key` allocation. Such kernel memory corruption is defensibly scored as enabling high confidentiality impact.\nI:H - The vulnerable `memcpy()` writes far beyond the allocated heap object, giving a heap buffer overflow primitive. Under the required higher-severity rule, this is scored as potentially enabling arbitrary kernel memory modification or code execution.\nA:H - The malformed token can reliably trigger massive out-of-bounds kernel memory access/corruption. At minimum this can cause a kernel oops or panic, producing high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/key.c"], "versions": [{"version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6", "lessThan": "3e04596cba8a86cbff9c3f4bf0a524a3a488773c", "status": "affected", "versionType": "git"}, {"version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6", "lessThan": "49875b360c2b83a3c226e189c502e501d83e6445", "status": "affected", "versionType": "git"}, {"version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6", "lessThan": "d179a868dd755b0cfcf7582e00943d702b9943b8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/key.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.23", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.13", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3e04596cba8a86cbff9c3f4bf0a524a3a488773c"}, {"url": "https://git.kernel.org/stable/c/49875b360c2b83a3c226e189c502e501d83e6445"}, {"url": "https://git.kernel.org/stable/c/d179a868dd755b0cfcf7582e00943d702b9943b8"}], "title": "rxrpc: Fix RxGK token loading to check bounds", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:6.12.0-211.26.1.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "unaffected", "packageName": "kpatch-patch", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "datePublic": "2026-04-24T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A flaw was found in the Linux kernel's rxrpc subsystem. An unprivileged local user could exploit an integer overflow vulnerability in the `rxrpc_preparse_xdr_yfs_rxgk()` function. This flaw occurs when processing specially crafted key and ticket lengths, causing an incorrect memory allocation size. Consequently, a heap buffer overflow can occur, potentially leading to arbitrary code execution or a denial of service."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-31641"}, {"name": "RHBZ#2461548", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461548"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31641.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:27288"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:55618"}], "solutions": [{"lang": "en", "value": "RHSA-2026:27288: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"}, {"lang": "en", "value": "RHSA-2026:55618: Red Hat Enterprise Linux BaseOS (v. 10)"}], "timeline": [{"lang": "en", "time": "2026-04-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-24T00:00:00.000Z", "value": "Made public."}], "title": "kernel: rxrpc: Fix RxGK token loading to check bounds", "workarounds": [{"lang": "en", "value": "The rxrpc kernel module can be prevented from loading to mitigate this issue. This action may impact applications that rely on the rxrpc protocol.\nTo blacklist the rxrpc module:\n1. Create a file `/etc/modprobe.d/blacklist-rxrpc.conf` with the following content:\n ```\n blacklist rxrpc\n install rxrpc /bin/true\n ```\n2. Regenerate the initramfs:\n ```bash\n dracut -f -v\n ```\n3. Reboot the system for the changes to take effect."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-20T12:31:55.191Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rxrpc/key.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3e04596cba8a86cbff9c3f4bf0a524a3a488773c", "status": "affected", "version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6", "versionType": "git"}, {"lessThan": "49875b360c2b83a3c226e189c502e501d83e6445", "status": "affected", "version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6", "versionType": "git"}, {"lessThan": "d179a868dd755b0cfcf7582e00943d702b9943b8", "status": "affected", "version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rxrpc/key.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.23", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:6.12.0-211.26.1.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "unaffected", "packageName": "kpatch-patch", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EAE31F43-AAC5-4801-B2B2-119D62A532A2", "versionEndExcluding": "6.18.23", "versionStartIncluding": "6.16.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1490EF9B-9080-481C-8D22-1306AAE664E4", "versionEndExcluding": "6.19.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*", "matchCriteriaId": "6238B17D-C12B-458F-A138-97039BFC4595", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix RxGK token loading to check bounds\n\nrxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length\nfrom the XDR token as u32 values and passes each through round_up(x, 4)\nbefore using the rounded value for validation and allocation. When the raw\nlength is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and\nkzalloc both use 0 while the subsequent memcpy still copies the original\n~4 GiB value, producing a heap buffer overflow reachable from an\nunprivileged add_key() call.\n\nFix this by:\n\n (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket\n lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with\n the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX.\n\n (2) Sizing the flexible-array allocation from the validated raw key\n length via struct_size_t() instead of the rounded value.\n\n (3) Caching the raw lengths so that the later field assignments and\n memcpy calls do not re-read from the token, eliminating a class of\n TOCTOU re-parse.\n\nThe control path (valid token with lengths within bounds) is unaffected."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: rxrpc: Soluci\u00f3n para la carga de tokens RxGK para verificar los l\u00edmites rxrpc_preparse_xdr_yfs_rxgk() lee la longitud de clave sin procesar y la longitud de ticket del token XDR como valores u32 y pasa cada uno a trav\u00e9s de round_up(x, 4) antes de usar el valor redondeado para validaci\u00f3n y asignaci\u00f3n. Cuando la longitud sin procesar es mayor o igual que 0x fffffffd, round_up() se ajusta a 0, por lo que la verificaci\u00f3n de l\u00edmites y kzalloc usan 0 mientras que el memcpy posterior a\u00fan copia el valor original de ~4 GiB, produciendo un desbordamiento de b\u00fafer de pila alcanzable desde una llamada add_key() no privilegiada. Esto se soluciona mediante: (1) Rechazando longitudes de clave sin procesar superiores a AFSTOKEN_GK_KEY_MAX y longitudes de ticket sin procesar superiores a AFSTOKEN_GK_TOKEN_MAX antes del redondeo, consistente con los l\u00edmites que la ruta RxKAD ya impone a trav\u00e9s de AFSTOKEN_RK_TIX_MAX. (2) Dimensionando la asignaci\u00f3n de array flexible a partir de la longitud de clave sin procesar validada a trav\u00e9s de struct_size_t() en lugar del valor redondeado. (3) Almacenando en cach\u00e9 las longitudes sin procesar para que las asignaciones de campo posteriores y las llamadas memcpy no vuelvan a leer del token, eliminando una clase de re-an\u00e1lisis TOCTOU. La ruta de control (token v\u00e1lido con longitudes dentro de los l\u00edmites) no se ve afectada."}], "id": "CVE-2026-31641", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}, "published": "2026-04-24T15:16:43.463", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3e04596cba8a86cbff9c3f4bf0a524a3a488773c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/49875b360c2b83a3c226e189c502e501d83e6445"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d179a868dd755b0cfcf7582e00943d702b9943b8"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:27288"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:55618"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-31641"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461548"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31641.json"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-190"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: rxrpc: Fix RxGK token loading to check bounds", "id": "2461548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461548"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in the Linux kernel's rxrpc subsystem. An unprivileged local user could exploit an integer overflow vulnerability in the `rxrpc_preparse_xdr_yfs_rxgk()` function. This flaw occurs when processing specially crafted key and ticket lengths, causing an incorrect memory allocation size. Consequently, a heap buffer overflow can occur, potentially leading to arbitrary code execution or a denial of service."], "name": "CVE-2026-31641", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31641\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31641\nhttps://lore.kernel.org/linux-cve-announce/2026042457-CVE-2026-31641-2dee@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ca100ff4df64f5d0f6c1dd5080c3e096786bea6,3e04596cba8a86cbff9c3f4bf0a524a3a488773c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ca100ff4df64f5d0f6c1dd5080c3e096786bea6,49875b360c2b83a3c226e189c502e501d83e6445)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ca100ff4df64f5d0f6c1dd5080c3e096786bea6,d179a868dd755b0cfcf7582e00943d702b9943b8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.23,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.13,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T20:05:22.639394+00:00", "value": {"mitigation_remediation": ["Apply the latest Linux kernel update that includes the backported fix for CVE\u20112026\u201131641, referencing commit c3e04596cba8a86cbff9c3f4bf0a524a3a488773c and subsequent related commits.", "If immediate kernel upgrade is not possible, restrict the use of the add_key() system call by SELinux, AppArmor, or other Linux security modules to prevent untrusted applications from creating keys.", "Disable or mitigate RxRPC usage on the affected systems by configuring network services to avoid loading the RxRPC module or by applying custom kernel parameters that drop the problematic code paths."], "summary": {"action": "Immediate Patch", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Linux kernel versions 6.16 and all 7.0 release candidates from rc1 through rc7 are impacted until the flaw is patched. Any system running these kernels and allowing the add_key() operation is vulnerable.", "description_and_impact": "The flaw lies in the Linux kernel's handling of RxGK token data during the add_key() system call. Raw key and ticket lengths are read as 32\u2011bit values and rounded up before allocation. If a length reaches or exceeds 0xFFFFFFFD, the rounding function wraps to zero, causing the kernel to allocate a zero\u2011byte buffer yet subsequently copy almost 4\u202fGiB of data into it. This overflow can corrupt the heap, leading to undefined behavior and enabling an unprivileged user to trigger local privilege escalation by corrupting kernel memory. The vulnerability is a classic heap buffer overflow (CWE\u2011125) coupled with a signed integer wraparound (CWE\u2011190).", "risk_and_exploitability": "The CVSS score of 7.8 rates the flaw as high severity, while the EPSS score of less than 1% indicates a low probability of current exploitation. It is not listed in the CISA KEV catalog, suggesting no widespread active exploitation yet. The flaw can be triggered from user space via the unprivileged add_key() call, requiring no elevated privileges. Attackers would need to supply a crafted RxGK token to an enabled RxRPC component. Successful exploitation could lead to full local privilege escalation if memory corruption is leveraged effectively. Overall, the risk is significant for systems that regularly process RxGK tokens or expose add_key() to untrusted users."}}}}, "created": "2026-04-27T18:45:11.320573+00:00", "updated": "2026-04-28T20:15:26.807905+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}