CVE-2026-31637

rxrpc: reject undecryptable rxkad response tickets

State: Published
Severity: 9.8 Critical
Published: Apr 24, 2026
Updated: Oct 19, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: reject undecryptable rxkad response tickets

rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded.

A malformed RESPONSE can therefore use a non-block-aligned ticket length, make the decrypt operation fail, and still drive the ticket parser with attacker-controlled bytes.

Check the decrypt result and abort the connection with RXKADBADTICKET when ticket decryption fails.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-754 Improper Check for Unusual or Exceptional Conditions

Affected Products

Product	Versions
LinuxLinux	17926a79320afa9b95df6b977b40cca6d8713cea to before 252157d939d179b5d767cb860ff8fa7f8723b67aAffected 17926a79320afa9b95df6b977b40cca6d8713cea to before a75b3b361dd481d942c5f259a82d59718a41092cAffected 17926a79320afa9b95df6b977b40cca6d8713cea to before b3a808cd0790b5075aaa2bc3588edf02cd71d352Affected 17926a79320afa9b95df6b977b40cca6d8713cea to before 47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8aAffected 17926a79320afa9b95df6b977b40cca6d8713cea to before a149dcae23309df9de1c3b6b5d468610ef5ab7deAffected 17926a79320afa9b95df6b977b40cca6d8713cea to before 22f6258e7b31dba9bf88dce4e3ee7f0f20072e60Affected 17926a79320afa9b95df6b977b40cca6d8713cea to before 58fcd1b156152613ba00a064a129fb69507ddd7dAffected 17926a79320afa9b95df6b977b40cca6d8713cea to before fe4447cd95623b1cfacc15f280aab73a6d7340b2Affected
LinuxLinux	2.6.22Affected before 2.6.22Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.135 through 6.6.Not affected 6.12.82 through 6.12.Not affected 6.18.23 through 6.18.Not affected 6.19.13 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

17926a79320afa9b95df6b977b40cca6d8713cea to before 252157d939d179b5d767cb860ff8fa7f8723b67aAffected
17926a79320afa9b95df6b977b40cca6d8713cea to before a75b3b361dd481d942c5f259a82d59718a41092cAffected
17926a79320afa9b95df6b977b40cca6d8713cea to before b3a808cd0790b5075aaa2bc3588edf02cd71d352Affected
17926a79320afa9b95df6b977b40cca6d8713cea to before 47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8aAffected
17926a79320afa9b95df6b977b40cca6d8713cea to before a149dcae23309df9de1c3b6b5d468610ef5ab7deAffected
17926a79320afa9b95df6b977b40cca6d8713cea to before 22f6258e7b31dba9bf88dce4e3ee7f0f20072e60Affected
17926a79320afa9b95df6b977b40cca6d8713cea to before 58fcd1b156152613ba00a064a129fb69507ddd7dAffected
17926a79320afa9b95df6b977b40cca6d8713cea to before fe4447cd95623b1cfacc15f280aab73a6d7340b2Affected

LinuxLinux

2.6.22Affected
before 2.6.22Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.135 through 6.6.*Not affected
6.12.82 through 6.12.*Not affected
6.18.23 through 6.18.*Not affected
6.19.13 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.