CVE-2026-31696

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix missing validation of ticket length in non-XDR key preparsing

In rxrpc_preparse(), there are two paths for parsing key payloads: the

XDR path (for large payloads) and the non-XDR path (for payloads <= 28

bytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly

validates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR

path fails to do so.

This allows an unprivileged user to provide a very large ticket length.

When this key is later read via rxrpc_read(), the total

token size (toksize) calculation results in a value that exceeds

AFSTOKEN_LENGTH_MAX, triggering a WARN_ON().

[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]

Fix this by adding a check in the non-XDR parsing path of rxrpc_preparse()

to ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,

bringing it into parity with the XDR parsing logic.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References