CVE-2026-31696

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31696", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.131Z", "datePublished": "2026-05-01T13:55:57.485Z", "dateUpdated": "2026-11-06T15:32:23.459Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-14T17:43:27.449Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix missing validation of ticket length in non-XDR key preparsing\n\nIn rxrpc_preparse(), there are two paths for parsing key payloads: the\nXDR path (for large payloads) and the non-XDR path (for payloads <= 28\nbytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly\nvalidates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR\npath fails to do so.\n\nThis allows an unprivileged user to provide a very large ticket length.\nWhen this key is later read via rxrpc_read(), the total\ntoken size (toksize) calculation results in a value that exceeds\nAFSTOKEN_LENGTH_MAX, triggering a WARN_ON().\n\n[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]\n\nFix this by adding a check in the non-XDR parsing path of rxrpc_preparse()\nto ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,\nbringing it into parity with the XDR parsing logic."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/key.c"], "versions": [{"version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "44714dfda386884919ba366411880b6fb3c3efd3", "status": "affected", "versionType": "git"}, {"version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "41a117dd80371343babc52198d1114e83eb37627", "status": "affected", "versionType": "git"}, {"version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "9a397aa9b5e53ca63d4d6aefb542832eca389618", "status": "affected", "versionType": "git"}, {"version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "1fa36cf495b0023e8475d038535c05e4063211e1", "status": "affected", "versionType": "git"}, {"version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "4458757c020592a3094366e0fb20457383b42f92", "status": "affected", "versionType": "git"}, {"version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "ce383ba615339f8eaec646a166d2c2b015bb5ca0", "status": "affected", "versionType": "git"}, {"version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "a1be1c9ece26cea69654f28b255ff9a7906b897b", "status": "affected", "versionType": "git"}, {"version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "ac33733b10b484d666f97688561670afd5861383", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/key.c"], "versions": [{"version": "3.17", "status": "affected"}, {"version": "0", "lessThan": "3.17", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.84", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.25", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.2", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.12.84"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.18.25"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "7.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/44714dfda386884919ba366411880b6fb3c3efd3"}, {"url": "https://git.kernel.org/stable/c/41a117dd80371343babc52198d1114e83eb37627"}, {"url": "https://git.kernel.org/stable/c/9a397aa9b5e53ca63d4d6aefb542832eca389618"}, {"url": "https://git.kernel.org/stable/c/1fa36cf495b0023e8475d038535c05e4063211e1"}, {"url": "https://git.kernel.org/stable/c/4458757c020592a3094366e0fb20457383b42f92"}, {"url": "https://git.kernel.org/stable/c/ce383ba615339f8eaec646a166d2c2b015bb5ca0"}, {"url": "https://git.kernel.org/stable/c/a1be1c9ece26cea69654f28b255ff9a7906b897b"}, {"url": "https://git.kernel.org/stable/c/ac33733b10b484d666f97688561670afd5861383"}], "title": "rxrpc: Fix missing validation of ticket length in non-XDR key preparsing", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:54.785Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31696", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:24:31.625988Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:32:23.459Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:54.785Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31696", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:24:31.625988Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:24:32.625Z"}}], "cna": {"title": "rxrpc: Fix missing validation of ticket length in non-XDR key preparsing", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "44714dfda386884919ba366411880b6fb3c3efd3", "versionType": "git"}, {"status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "41a117dd80371343babc52198d1114e83eb37627", "versionType": "git"}, {"status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "9a397aa9b5e53ca63d4d6aefb542832eca389618", "versionType": "git"}, {"status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "1fa36cf495b0023e8475d038535c05e4063211e1", "versionType": "git"}, {"status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "4458757c020592a3094366e0fb20457383b42f92", "versionType": "git"}, {"status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "ce383ba615339f8eaec646a166d2c2b015bb5ca0", "versionType": "git"}, {"status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "a1be1c9ece26cea69654f28b255ff9a7906b897b", "versionType": "git"}, {"status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "lessThan": "ac33733b10b484d666f97688561670afd5861383", "versionType": "git"}], "programFiles": ["net/rxrpc/key.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.17"}, {"status": "unaffected", "version": "0", "lessThan": "3.17", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.136", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.84", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.25", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.2", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/rxrpc/key.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/44714dfda386884919ba366411880b6fb3c3efd3"}, {"url": "https://git.kernel.org/stable/c/41a117dd80371343babc52198d1114e83eb37627"}, {"url": "https://git.kernel.org/stable/c/9a397aa9b5e53ca63d4d6aefb542832eca389618"}, {"url": "https://git.kernel.org/stable/c/1fa36cf495b0023e8475d038535c05e4063211e1"}, {"url": "https://git.kernel.org/stable/c/4458757c020592a3094366e0fb20457383b42f92"}, {"url": "https://git.kernel.org/stable/c/ce383ba615339f8eaec646a166d2c2b015bb5ca0"}, {"url": "https://git.kernel.org/stable/c/a1be1c9ece26cea69654f28b255ff9a7906b897b"}, {"url": "https://git.kernel.org/stable/c/ac33733b10b484d666f97688561670afd5861383"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix missing validation of ticket length in non-XDR key preparsing\n\nIn rxrpc_preparse(), there are two paths for parsing key payloads: the\nXDR path (for large payloads) and the non-XDR path (for payloads <= 28\nbytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly\nvalidates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR\npath fails to do so.\n\nThis allows an unprivileged user to provide a very large ticket length.\nWhen this key is later read via rxrpc_read(), the total\ntoken size (toksize) calculation results in a value that exceeds\nAFSTOKEN_LENGTH_MAX, triggering a WARN_ON().\n\n[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]\n\nFix this by adding a check in the non-XDR parsing path of rxrpc_preparse()\nto ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,\nbringing it into parity with the XDR parsing logic."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.136", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.84", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.25", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.2", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "3.17"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-14T17:43:27.449Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31696", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:32:23.459Z", "dateReserved": "2026-03-09T15:48:24.131Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-01T13:55:57.485Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rxrpc/key.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "44714dfda386884919ba366411880b6fb3c3efd3", "status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "versionType": "git"}, {"lessThan": "41a117dd80371343babc52198d1114e83eb37627", "status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "versionType": "git"}, {"lessThan": "9a397aa9b5e53ca63d4d6aefb542832eca389618", "status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "versionType": "git"}, {"lessThan": "1fa36cf495b0023e8475d038535c05e4063211e1", "status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "versionType": "git"}, {"lessThan": "4458757c020592a3094366e0fb20457383b42f92", "status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "versionType": "git"}, {"lessThan": "ce383ba615339f8eaec646a166d2c2b015bb5ca0", "status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "versionType": "git"}, {"lessThan": "a1be1c9ece26cea69654f28b255ff9a7906b897b", "status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "versionType": "git"}, {"lessThan": "ac33733b10b484d666f97688561670afd5861383", "status": "affected", "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rxrpc/key.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.17"}, {"lessThan": "3.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.84", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.25", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C73D2808-65F0-4CE5-A194-0FCDE4D23BFC", "versionEndExcluding": "6.6.136", "versionStartIncluding": "3.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7", "versionEndExcluding": "6.12.84", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C", "versionEndExcluding": "6.18.25", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8", "versionEndExcluding": "7.0.2", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix missing validation of ticket length in non-XDR key preparsing\n\nIn rxrpc_preparse(), there are two paths for parsing key payloads: the\nXDR path (for large payloads) and the non-XDR path (for payloads <= 28\nbytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly\nvalidates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR\npath fails to do so.\n\nThis allows an unprivileged user to provide a very large ticket length.\nWhen this key is later read via rxrpc_read(), the total\ntoken size (toksize) calculation results in a value that exceeds\nAFSTOKEN_LENGTH_MAX, triggering a WARN_ON().\n\n[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]\n\nFix this by adding a check in the non-XDR parsing path of rxrpc_preparse()\nto ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,\nbringing it into parity with the XDR parsing logic."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: Arreglo de la validaci\u00f3n faltante de la longitud del ticket en el prean\u00e1lisis de claves no-XDR\n\nEn rxrpc_preparse(), hay dos rutas para analizar cargas \u00fatiles de claves: la ruta XDR (para cargas \u00fatiles grandes) y la ruta no-XDR (para cargas \u00fatiles menor o igual que 28 bytes). Mientras que la ruta XDR (rxrpc_preparse_xdr_rxkad()) valida correctamente la longitud del ticket contra AFSTOKEN_RK_TIX_MAX, la ruta no-XDR falla en hacerlo.\n\nEsto permite a un usuario no privilegiado proporcionar una longitud de ticket muy grande. Cuando esta clave es le\u00edda posteriormente a trav\u00e9s de rxrpc_read(), el c\u00e1lculo del tama\u00f1o total del token (toksize) resulta en un valor que excede AFSTOKEN_LENGTH_MAX, desencadenando un WARN_ON().\n\n[ 2001.302904] ADVERTENCIA: CPU: 2 PID: 2108 en net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]\n\nSolucione esto a\u00f1adiendo una verificaci\u00f3n en la ruta de an\u00e1lisis no-XDR de rxrpc_preparse() para asegurar que la longitud del ticket no exceda AFSTOKEN_RK_TIX_MAX, poni\u00e9ndolo a la par con la l\u00f3gica de an\u00e1lisis XDR."}], "id": "CVE-2026-31696", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31696", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:24:31.625988Z", "version": "2.0.3"}}]}, "published": "2026-05-01T14:16:19.403", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1fa36cf495b0023e8475d038535c05e4063211e1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/41a117dd80371343babc52198d1114e83eb37627"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4458757c020592a3094366e0fb20457383b42f92"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/44714dfda386884919ba366411880b6fb3c3efd3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9a397aa9b5e53ca63d4d6aefb542832eca389618"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a1be1c9ece26cea69654f28b255ff9a7906b897b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ac33733b10b484d666f97688561670afd5861383"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ce383ba615339f8eaec646a166d2c2b015bb5ca0"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing", "id": "2464467", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464467"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in the Linux kernel's rxrpc component. An unprivileged user can exploit this by providing an excessively large ticket length during key preparsing. This improper validation leads to an oversized token calculation when the key is subsequently read, triggering a system warning and potentially causing a Denial of Service (DoS)."], "name": "CVE-2026-31696", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31696\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31696\nhttps://lore.kernel.org/linux-cve-announce/2026050118-CVE-2026-31696-d2de@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247,1fa36cf495b0023e8475d038535c05e4063211e1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247,4458757c020592a3094366e0fb20457383b42f92)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247,ce383ba615339f8eaec646a166d2c2b015bb5ca0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247,a1be1c9ece26cea69654f28b255ff9a7906b897b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247,ac33733b10b484d666f97688561670afd5861383)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.84,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.25,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.2,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T21:30:14.957917+00:00", "updated": "2026-05-06T21:15:13.604088+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}