Loading vulnerability…
Linux kernel RxRPC oversized RESPONSE authenticator length validation flaw
CVE-2026-31635 is an input-validation flaw in the Linux kernel RxRPC RxGK response-authentication path. The rxgk_verify_response() function decodes an authenticator length from an RxRPC RESPONSE packet but used an inverted bounds check, accepting lengths that exceed the remaining packet payload. The oversized value can then be passed to rxgk_decrypt_skb(), which may invoke skb_to_sgvec() with an impossible length and trigger a kernel BUG assertion.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A crafted malformed RxRPC RESPONSE can cause a kernel BUG assertion in the RxGK decryption path, resulting in a denial of service through kernel crash or panic. The available authoritative vulnerability details establish denial-of-service impact; they do not establish local privilege escalation or page-cache modification as impacts of this specific bounds-check flaw.
If you can’t patch tonight, do this now.
Until a patched kernel can be deployed, reduce exposure to RxRPC/RxGK traffic and disable or unload the RxRPC functionality where it is not operationally required. Validate that disabling the subsystem does not disrupt dependent RPC or filesystem services.
Patch, then assume compromise.
Install a Linux kernel update containing the RxRPC RxGK fix that rejects RESPONSE authenticator lengths exceeding the remaining packet payload, then reboot into the updated kernel.
4 exploits validated by Mallory's analysis. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
54 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.