CVE-2026-31630

rxrpc: proc: size address buffers for %pISpc output

State: Published
Severity: 7.8 High
Published: Apr 24, 2026
Updated: Oct 21, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: proc: size address buffers for %pISpc output

The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc".

That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap().

As a result, a case such as

[ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535

is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c.

Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf().

Changes since v1: - correct the changelog to cite the actual maximum current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-121 Stack-based Buffer Overflow

Affected Products

Product	Versions
LinuxLinux	75b54cb57ca34cbe7a87c6ac757c55360a624590 to before 386c86412608d3449006a318a662cbcd6ca1f668Affected 75b54cb57ca34cbe7a87c6ac757c55360a624590 to before 235b2115de892eab2e107a42efa7a4347baaa80bAffected 75b54cb57ca34cbe7a87c6ac757c55360a624590 to before 625af53a1564e31bb2df9adc3739df46137f46c1Affected 75b54cb57ca34cbe7a87c6ac757c55360a624590 to before 808a34cdbe8ce336c202d8ea6d5e48496764dc37Affected 75b54cb57ca34cbe7a87c6ac757c55360a624590 to before a6042b8066b24dbcc7945616a157d4d43e463668Affected 75b54cb57ca34cbe7a87c6ac757c55360a624590 to before db297c78ce537c9ac96f0eda9b25ad72c8caefa9Affected 75b54cb57ca34cbe7a87c6ac757c55360a624590 to before 10ebed83f9f6414af4e85bc85ffaeda7effdd874Affected 75b54cb57ca34cbe7a87c6ac757c55360a624590 to before a44ce6aa2efb61fe44f2cfab72bb01544bbca272Affected
LinuxLinux	4.9Affected before 4.9Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.23 through 6.18.Not affected 6.19.13 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

75b54cb57ca34cbe7a87c6ac757c55360a624590 to before 386c86412608d3449006a318a662cbcd6ca1f668Affected
75b54cb57ca34cbe7a87c6ac757c55360a624590 to before 235b2115de892eab2e107a42efa7a4347baaa80bAffected
75b54cb57ca34cbe7a87c6ac757c55360a624590 to before 625af53a1564e31bb2df9adc3739df46137f46c1Affected
75b54cb57ca34cbe7a87c6ac757c55360a624590 to before 808a34cdbe8ce336c202d8ea6d5e48496764dc37Affected
75b54cb57ca34cbe7a87c6ac757c55360a624590 to before a6042b8066b24dbcc7945616a157d4d43e463668Affected
75b54cb57ca34cbe7a87c6ac757c55360a624590 to before db297c78ce537c9ac96f0eda9b25ad72c8caefa9Affected
75b54cb57ca34cbe7a87c6ac757c55360a624590 to before 10ebed83f9f6414af4e85bc85ffaeda7effdd874Affected
75b54cb57ca34cbe7a87c6ac757c55360a624590 to before a44ce6aa2efb61fe44f2cfab72bb01544bbca272Affected

LinuxLinux

4.9Affected
before 4.9Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.23 through 6.18.*Not affected
6.19.13 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.