Junglewise Threat Intelligence

CVE-2026-31696: Linux Kernel rxrpc out-of-bounds write in key preparsing

CVE-2026-31696 · Severity: high · CVSS 7.8 · Published 2026-05-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to cause system instability or potentially gain unauthorized access. The issue occurs when the system processes specific security keys used for network communication. An attacker with basic access to the system could exploit this to crash the kernel or potentially execute malicious code.

Technical details

A vulnerability exists in the rxrpc_preparse() function within the Linux kernel's AF_RXRPC implementation. While the XDR parsing path correctly validates ticket lengths, the non-XDR path (used for payloads <= 28 bytes) fails to check the ticket_length against AFSTOKEN_RK_TIX_MAX. An unprivileged local user can provide a specially crafted key payload with an excessively large ticket length. When this key is subsequently read via rxrpc_read(), it can trigger a WARN_ON() or lead to an out-of-bounds write (CWE-787) because the calculated token size exceeds internal limits. Patches have been released for various stable kernel branches.

Affected products

  • Linux Linux Kernel 3.17 to 6.6.136, 6.7 to 6.12.84, 6.13 to 6.18.25, 6.19 to 7.0.2

Timeline

  • 2026-04-22: other: Vulnerability reported by Anderson Nascimento
  • 2026-05-01: disclosed: Initial CVE publication
  • 2026-06-01: patched: Final stable branch patches applied

References