CVE-2026-31633

rxrpc: Fix integer overflow in rxgk_verify_response()

State: Published
Severity: 9.8 Critical
Published: Apr 24, 2026
Updated: Oct 19, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix integer overflow in rxgk_verify_response()

In rxgk_verify_response(), there's a potential integer overflow due to rounding up token_len before checking it, thereby allowing the length check to be bypassed.

Fix this by checking the unrounded value against len too (len is limited as the response must fit in a single UDP packet).

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a to before 1f864d9daaf622aeaa774404fd51e7d6a435b046Affected 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a to before c1e242beb6b1efc3c286f617e8d940c8fbf2ed41Affected 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a to before 699e52180f4231c257821c037ed5c99d5eb0edb8Affected
LinuxLinux	6.16Affected before 6.16Not affected 6.18.23 through 6.18.Not affected 6.19.13 through 6.19.Not affected 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.