---
id: CVE-2026-31641
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rxrpc: Fix RxGK token loading to check bounds

  rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length
  from the XDR token as u32 values and passes each…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rxrpc: Fix RxGK token loading to check bounds

  rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length
  from the XDR token as u32 values and passes each…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-125
  - CWE-190
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.16.1, < 6.18.23'
  - 'linux_kernel >= 6.19, < 6.19.13'
  - linux_kernel = 6.16
  - linux_kernel = 7.0
patched:
  - linux_kernel 6.19.13
published: '2026-04-24'
updated: '2026-08-18'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31641'
references:
  - url: 'https://git.kernel.org/stable/c/3e04596cba8a86cbff9c3f4bf0a524a3a488773c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/49875b360c2b83a3c226e189c502e501d83e6445'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d179a868dd755b0cfcf7582e00943d702b9943b8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://access.redhat.com/errata/RHSA-2026:27288'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:55618'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-31641'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2461548'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31641.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.0019
epssPercentile: 0.07697
ingestedAt: '2026-08-18T13:17:08.568Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix RxGK token loading to check bounds

rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length
from the XDR token as u32 values and passes each through round_up(x, 4)
before using the rounded value for validation and allocation.  When the raw
length is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and
kzalloc both use 0 while the subsequent memcpy still copies the original
~4 GiB value, producing a heap buffer overflow reachable from an
unprivileged add_key() call.

Fix this by:

 (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket
     lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with
     the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX.

 (2) Sizing the flexible-array allocation from the validated raw key
     length via struct_size_t() instead of the rounded value.

 (3) Caching the raw lengths so that the later field assignments and
     memcpy calls do not re-read from the token, eliminating a class of
     TOCTOU re-parse.

The control path (valid token with lengths within bounds) is unaffected.

## Affected

- `linux_kernel >= 6.16.1, < 6.18.23`
- `linux_kernel >= 6.19, < 6.19.13`
- `linux_kernel = 6.16`
- `linux_kernel = 7.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.13`