CVE-2026-31636

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: fix RESPONSE authenticator parser OOB read

rxgk_verify_authenticator() copies auth_len bytes into a temporary

buffer and then passes p + auth_len as the parser limit to

rxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the

parser end pointer by a factor of four and lets malformed RESPONSE

authenticators read past the kmalloc() buffer.

Decoded from the original latest-net reproduction logs with

scripts/decode_stacktrace.sh:

BUG: KASAN: slab-out-of-bounds in rxgk_verify_response()

Call Trace:

dump_stack_lvl() [lib/dump_stack.c:123]

print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482]

kasan_report() [mm/kasan/report.c:597]

rxgk_verify_response()

[net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167

net/rxrpc/rxgk.c:1274]

rxrpc_process_connection()

[net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364

net/rxrpc/conn_event.c:386]

process_one_work() [kernel/workqueue.c:3281]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References