CVE-2026-31635

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory corruption issue exists in the RxRPC subsystem of the Linux kernel, specifically within the rxgk verify response() function. The function incorrectly validates the auth len parameter from packets due to an inverted check, allowing oversized RESPONSE authenticators to be processed. These are passed to rxgk decrypt skb(), which may modify shared packet memory without proper copy-on-write validation. This can lead to an impossible length being passed to skb to sgvec(), triggering a BUG ON(len) kernel panic or allowing arbitrary kernel writes. Local attackers can exploit this flaw to cause a denial of service or achieve root-level privilege escalation. The issue affects systems with CONFIG RXGK enabled, including distributions such as Fedora, Arch Linux, and openSUSE Tumbleweed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.