Executive brief
A vulnerability in the Linux kernel's networking component could allow a remote attacker to crash the system. The issue exists in the AF_RXRPC protocol implementation, which is used for certain types of network communications. By sending a specially crafted network packet, an attacker can trigger a kernel panic, leading to a complete service outage.
Technical details
A vulnerability in rxgk_verify_response() in the Linux kernel's rxrpc implementation stems from an inverted length check. The function decodes 'auth_len' from a packet but fails to correctly verify that it fits within the remaining buffer bytes due to the inverted logic. This allows oversized RESPONSE authenticators to be passed to rxgk_decrypt_skb(), which eventually calls skb_to_sgvec() with an invalid length. This triggers a BUG_ON() in the kernel, resulting in a denial-of-service (kernel panic). The vulnerability is reachable over the network without authentication. Patches have been released for various stable branches including 6.16.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.16.1 to 6.18.23, 6.19 to 6.19.13, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-08: patched: Initial fix committed to mainline kernel
- 2026-04-24: disclosed: CVE-2026-31635 published
- 2026-05-18: advisory: NVD record updated with additional CWE and PoC information