CVE-2026-31630

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: proc: size address buffers for %pISpc output

The AF_RXRPC procfs helpers format local and remote socket addresses into

fixed 50-byte stack buffers with "%pISpc".

That is too small for the longest current-tree IPv6-with-port form the

formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a

dotted-quad tail not only for v4mapped addresses, but also for ISATAP

addresses via ipv6_addr_is_isatap().

As a result, a case such as

[ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535

is possible with the current formatter. That is 50 visible characters, so

51 bytes including the trailing NUL, which does not fit in the existing

char[50] buffers used by net/rxrpc/proc.c.

Size the buffers from the formatter's maximum textual form and switch the

call sites to scnprintf().

Changes since v1:

- correct the changelog to cite the actual maximum current-tree case

explicitly

- frame the proof around the ISA

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References