{"id":"CVE-2026-31641","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix RxGK token loading to check bounds\n\nrxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length\nfrom the XDR token as u32 values and passes each…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix RxGK token loading to check bounds\n\nrxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length\nfrom the XDR token as u32 values and passes each…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-125","CWE-190"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.16.1, < 6.18.23","linux_kernel >= 6.19, < 6.19.13","linux_kernel = 6.16","linux_kernel = 7.0"],"patched":["linux_kernel 6.19.13"],"published":"2026-04-24","updated":"2026-08-18","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31641","references":[{"url":"https://git.kernel.org/stable/c/3e04596cba8a86cbff9c3f4bf0a524a3a488773c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49875b360c2b83a3c226e189c502e501d83e6445","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d179a868dd755b0cfcf7582e00943d702b9943b8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://access.redhat.com/errata/RHSA-2026:27288","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:55618","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-31641","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461548","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31641.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"tags":["nvd"],"epss":0.0019,"epssPercentile":0.07697,"ingestedAt":"2026-08-18T13:17:08.568Z","slug":"CVE-2026-31641","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix RxGK token loading to check bounds\n\nrxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length\nfrom the XDR token as u32 values and passes each through round_up(x, 4)\nbefore using the rounded value for validation and allocation.  When the raw\nlength is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and\nkzalloc both use 0 while the subsequent memcpy still copies the original\n~4 GiB value, producing a heap buffer overflow reachable from an\nunprivileged add_key() call.\n\nFix this by:\n\n (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket\n     lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with\n     the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX.\n\n (2) Sizing the flexible-array allocation from the validated raw key\n     length via struct_size_t() instead of the rounded value.\n\n (3) Caching the raw lengths so that the later field assignments and\n     memcpy calls do not re-read from the token, eliminating a class of\n     TOCTOU re-parse.\n\nThe control path (valid token with lengths within bounds) is unaffected.\n\n## Affected\n\n- `linux_kernel >= 6.16.1, < 6.18.23`\n- `linux_kernel >= 6.19, < 6.19.13`\n- `linux_kernel = 6.16`\n- `linux_kernel = 7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.19.13`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}