CVE-2026-31641
published 2026-04-24CVE-2026-31641: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rxgk() reads the raw…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
4.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix RxGK token loading to check bounds
rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length
from the XDR token as u32 values and passes each through round_up(x, 4)
before using the rounded value for validation and allocation. When the raw
length is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and
kzalloc both use 0 while the subsequent memcpy still copies the original
~4 GiB value, producing a heap buffer overflow reachable from an
unprivileged add_key() call.
Fix this by:
(1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket
lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with
the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX.
(2) Sizing the flexible-array allocation from the validated raw key
length via struct_size_t() instead of the rounded value.
(3) Caching the raw lengths so that the later field assignments and
memcpy calls do not re-read from the token, eliminating a class of
TOCTOU re-parse.
The control path (valid token with lengths within bounds) is unaffected.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 0ca100ff4df64f5d0f6c1dd5080c3e096786bea6 < 3e04596cba8a86cbff9c3f4bf0a524a3a488773c | 3e04596cba8a86cbff9c3f4bf0a524a3a488773c |
| linux | linux | >= 0ca100ff4df64f5d0f6c1dd5080c3e096786bea6 < 49875b360c2b83a3c226e189c502e501d83e6445 | 49875b360c2b83a3c226e189c502e501d83e6445 |
| linux | linux | >= 0ca100ff4df64f5d0f6c1dd5080c3e096786bea6 < d179a868dd755b0cfcf7582e00943d702b9943b8 | d179a868dd755b0cfcf7582e00943d702b9943b8 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.16.1 < 6.18.23 | 6.18.23 |
| linux | linux_kernel | >= 6.19 < 6.19.13 | 6.19.13 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p4pm-x7ch-5mvc: In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix RxGK token loading to check bounds
rxrpc_preparse_xdr_yfs_rxgk() read
ghsa_unreviewed·2026-04-24
CVE-2026-31641 GHSA-p4pm-x7ch-5mvc: In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix RxGK token loading to check bounds
rxrpc_preparse_xdr_yfs_rxgk() read
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix RxGK token loading to check bounds
rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length
from the XDR token as u32 values and passes each through round_up(x, 4)
before using the rounded value for validation and allocation. When the raw
length is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and
kzalloc both use 0 while the subsequent memcpy still copies the original
~4 GiB value, producing a heap buffer overflow reachable from an
unprivileged add_key() call.
Fix this by:
(1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket
lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with
the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX.
Red Hat
kernel: rxrpc: Fix RxGK token loading to check bounds
vendor_redhat·2026-04-24·CVSS 7.0
CVE-2026-31641 [HIGH] CWE-190 kernel: rxrpc: Fix RxGK token loading to check bounds
kernel: rxrpc: Fix RxGK token loading to check bounds
A flaw was found in the Linux kernel's rxrpc subsystem. An unprivileged local user could exploit an integer overflow vulnerability in the `rxrpc_preparse_xdr_yfs_rxgk()` function. This flaw occurs when processing specially crafted key and ticket lengths, causing an incorrect memory allocation size. Consequently, a heap buffer overflow can occur, potentially leading to arbitrary code execution or a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/3e04596cba8a86cbff9c3f4bf0a524a3a488773chttps://git.kernel.org/stable/c/49875b360c2b83a3c226e189c502e501d83e6445https://git.kernel.org/stable/c/d179a868dd755b0cfcf7582e00943d702b9943b8https://access.redhat.com/errata/RHSA-2026:27288https://access.redhat.com/security/cve/CVE-2026-31641https://bugzilla.redhat.com/show_bug.cgi?id=2461548https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31641.json
2026-04-24
Published