CVE-2026-31641

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw in the rxrpc subsystem allows an unprivileged local user to exploit an integer overflow in the rxrpc preparse xdr yfs rxgk() function. The issue occurs when the function reads raw key and ticket lengths from an XDR token as u32 values and processes them using round up(x, 4). If the raw length is 0xfffffffd or greater, the rounding operation wraps to 0, causing the bounds check and kzalloc to use a size of 0. Subsequently, a memcpy operation copies the original large value (approximately 4 GiB), resulting in a heap buffer overflow. This can be triggered via an unprivileged add key() call and may lead to arbitrary code execution or a denial of service. This also eliminates a TOCTOU (Time-of-Check to Time-of-Use) re-parse condition by caching raw lengths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.