---
id: CVE-2026-31630
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rxrpc: proc: size address buffers for %pISpc output

  The AF_RXRPC procfs helpers format local and remote socket addresses into
  fixed 50-byte stack buffers with "%pISpc"…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rxrpc: proc: size address buffers for %pISpc output

  The AF_RXRPC procfs helpers format local and remote socket addresses into
  fixed 50-byte stack buffers with "%pISpc"…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.9.1, < 6.18.23'
  - 'linux_kernel >= 6.19, < 6.19.13'
  - linux_kernel = 4.9
  - linux_kernel = 7.0
patched:
  - linux_kernel 6.19.13
published: '2026-04-24'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:19:14.103'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31630'
references:
  - url: 'https://git.kernel.org/stable/c/10ebed83f9f6414af4e85bc85ffaeda7effdd874'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/235b2115de892eab2e107a42efa7a4347baaa80b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/386c86412608d3449006a318a662cbcd6ca1f668'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/625af53a1564e31bb2df9adc3739df46137f46c1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00176
epssPercentile: 0.06628
ingestedAt: '2026-10-15T03:30:12.861Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: proc: size address buffers for %pISpc output

The AF_RXRPC procfs helpers format local and remote socket addresses into
fixed 50-byte stack buffers with "%pISpc".

That is too small for the longest current-tree IPv6-with-port form the
formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a
dotted-quad tail not only for v4mapped addresses, but also for ISATAP
addresses via ipv6_addr_is_isatap().

As a result, a case such as

  [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535

is possible with the current formatter. That is 50 visible characters, so
51 bytes including the trailing NUL, which does not fit in the existing
char[50] buffers used by net/rxrpc/proc.c.

Size the buffers from the formatter's maximum textual form and switch the
call sites to scnprintf().

Changes since v1:
- correct the changelog to cite the actual maximum current-tree case
  explicitly
- frame the proof around the ISATAP formatting path instead of the earlier
  mapped-v4 example

## Affected

- `linux_kernel >= 4.9.1, < 6.18.23`
- `linux_kernel >= 6.19, < 6.19.13`
- `linux_kernel = 4.9`
- `linux_kernel = 7.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.13`