Junglewise Threat Intelligence

CVE-2026-31641: Linux Kernel heap buffer overflow in rxrpc RxGK token loading

CVE-2026-31641 · Severity: high · CVSS 7.8 · Published 2026-04-24

Technologies: Linux Kernel. Vendors: Red Hat, Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system or potentially gain unauthorized access. The issue occurs when the system processes specific security tokens used for network communication. An attacker with basic access to the system could exploit this to disrupt operations or compromise data integrity.

Technical details

A heap buffer overflow exists in rxrpc_preparse_xdr_yfs_rxgk() due to improper bounds checking and an integer wraparound. The function reads raw key and ticket lengths as u32 values and applies round_up(x, 4). If a length is >= 0xfffffffd, the rounding operation wraps to 0, causing kzalloc to allocate a zero-sized buffer while a subsequent memcpy attempts to copy approximately 4 GiB of data. This is reachable via an unprivileged add_key() call. The fix introduces strict length caps (AFSTOKEN_GK_KEY_MAX/AFSTOKEN_GK_TOKEN_MAX), uses struct_size_t for safe allocation, and caches raw lengths to prevent TOCTOU re-parsing issues.

Affected products

  • Linux Linux Kernel 0ca100ff4df64f5d0f6c1dd5080c3e096786bea6 to 3e04596cba8a86cbff9c3f4bf0a524a3a488773c
  • Red Hat Red Hat Enterprise Linux 10.2

Timeline

  • 2026-04-08: other: Patch authored
  • 2026-04-24: disclosed
  • 2026-04-24: advisory

References