HIGH
rxrpc RXGK Overflow
CVE-2026-31635
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an impossible length and hit BUG_ON(len). Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: RIP: __skb_to_sgvec() [net/core/skbuff.c:5285 (discriminator 1)] Call Trace: skb_to_sgvec() [net/core/skbuff.c:5305] rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81] rxgk_verify_response() [net/rxrpc/rxgk.c:1268] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Reject authenticator lengths that exceed the remaining packet payload.
02KernelScan AI Analysis
Risk summary
Remote attackers can crash the kernel by sending malformed RXGK authentication packets to systems running AFS/OpenAFS services. The vulnerability causes a kernel panic through a BUG_ON assertion when oversized authenticator lengths are processed. Systems exposing RxRPC services over the network are at risk of denial-of-service attacks.
Vulnerability analysis
The root cause is an inverted length check in rxgk_verify_response() where 'auth_len < len' should be 'auth_len > len'. This allows oversized RESPONSE authenticators to pass validation and reach rxgk_decrypt_skb(), which eventually calls skb_to_sgvec() with an impossible length parameter, triggering a BUG_ON assertion and kernel panic. The fix corrects the comparison operator to properly reject authenticator lengths that exceed the remaining packet payload. This vulnerability is network-reachable through the RxRPC protocol used by AFS services, requiring no authentication or privileges to trigger.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.18 | 6.18.23 | beee051f259a |
| 6.19 | 6.19.13 | e2f1a80d8b1e |
| mainline | 7.0 | a2567217ade9 |