{"id":"CVE-2026-31635","published":"2026-04-24T14:44:49Z","modified":"2026-08-05T12:23:59Z","title":"rxrpc: fix oversized RESPONSE authenticator length check","vendor":"Linux","product":"Linux","tier":"core","eol":null,"affectedVersions":[{"vendor":"Linux","product":"Linux","versions":[">= 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a, < beee051f259acd286fed64c32c2b31e6f5097eb5",">= 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a, < e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305",">= 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a, < a2567217ade970ecc458144b6be469bc015b23e5"]},{"vendor":"Linux","product":"Linux","versions":["6.16"]}],"description":{"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix oversized RESPONSE authenticator length check\n\nrxgk_verify_response() decodes auth_len from the packet and is supposed\nto verify that it fits in the remaining bytes. The existing check is\ninverted, so oversized RESPONSE authenticators are accepted and passed\nto rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an\nimpossible length and hit BUG_ON(len).\n\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\n\nRIP: __skb_to_sgvec()\n  [net/core/skbuff.c:5285 (discriminator 1)]\nCall Trace:\n skb_to_sgvec() [net/core/skbuff.c:5305]\n rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]\n rxgk_verify_response() [net/rxrpc/rxgk.c:1268]\n rxrpc_process_connection()\n   [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n    net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n   [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nReject authenticator lengths that exceed the remaining packet payload.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01017,"percentile":0.63299,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-26","exploitedFirstSeen":"2026-08-26","ransomware":false,"evidence":[{"url":"https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/","date":"2026-08-26"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | May 3, 2026","url":"https://otx.alienvault.com/pulse/69f61d7b1c7b6110a1ea04c5","created":"2026-05-02"},{"name":"Known_Cve | May 2, 2026","url":"https://otx.alienvault.com/pulse/69f4cbdd9d6792f5e0fe1441","created":"2026-05-01"},{"name":"Known_Cve | May 1, 2026","url":"https://otx.alienvault.com/pulse/69f378c160039674e6d8b0e2","created":"2026-04-30"},{"name":"Known_Cve | Apr 30, 2026","url":"https://otx.alienvault.com/pulse/69f22775c0cab1a8490f77d4","created":"2026-04-29"},{"name":"Known_Cve | Apr 29, 2026","url":"https://otx.alienvault.com/pulse/69f0d6daf049026984c0056a","created":"2026-04-28"},{"name":"Known_Cve | Apr 28, 2026","url":"https://otx.alienvault.com/pulse/69ef8579b85b581c4f7eec39","created":"2026-04-27"},{"name":"Known_Cve | Apr 27, 2026","url":"https://otx.alienvault.com/pulse/69ee331bb594352d6f03f42f","created":"2026-04-26"},{"name":"Known_Cve | Apr 26, 2026","url":"https://otx.alienvault.com/pulse/69ece1c766d687ee21cf62ab","created":"2026-04-25"}],"provenance":"machine"},"cwes":[{"id":"CWE-130","name":"Improper Handling of Length Parameter Inconsistency"}],"references":[{"url":"https://git.kernel.org/stable/c/beee051f259acd286fed64c32c2b31e6f5097eb5","tags":[]},{"url":"https://git.kernel.org/stable/c/e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305","tags":[]},{"url":"https://git.kernel.org/stable/c/a2567217ade970ecc458144b6be469bc015b23e5","tags":[]},{"url":"https://github.com/v12-security/pocs/tree/main/dirtydecrypt","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-25528","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25528","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2026-05-19","earliestUrl":"https://github.com/0xBlackash/CVE-2026-31635","repos":[{"name":"0xBlackash/CVE-2026-31635","url":"https://github.com/0xBlackash/CVE-2026-31635","stars":8,"created":"2026-05-19"},{"name":"0xFuffM3/CVE-2026-31635-DirtyDecrypt","url":"https://github.com/0xFuffM3/CVE-2026-31635-DirtyDecrypt","stars":3,"created":"2026-05-21"},{"name":"Koshmare-Blossom/DirtyDecrypt-go","url":"https://github.com/Koshmare-Blossom/DirtyDecrypt-go","stars":0,"created":"2026-05-21"}]},"first":{"date":"2026-05-19","source":"PoC-in-GitHub","url":"https://github.com/0xBlackash/CVE-2026-31635"},"provenance":"source"},"exploitRefs":["https://github.com/v12-security/pocs/tree/main/dirtydecrypt"],"flow":[],"timeline":[{"date":"2026-04-24","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-31635","provenance":"source"},{"date":"2026-05-19","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/0xBlackash/CVE-2026-31635","provenance":"source"},{"date":"2026-08-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/","provenance":"source"}],"speed":{"daysToPublicExploit":25,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":70.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 66 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":12.66,"detail":"percentile 0.6330"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}