Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-31633 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Linux Linux Kernel. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-31633 is an integer overflow vulnerability (CWE-190) in the Linux kernel's rxrpc subsystem, specifically within the rxgk_verify_response() function. The issue arises from rounding up the token_len value before performing a length check, which can bypass the validation and allow processing of malformed data. This affects Linux kernel versions prior to the application of the referenced patches, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By crafting a malicious response that triggers the integer overflow, attackers can bypass the length check intended to ensure the response fits within a single UDP packet, potentially leading to arbitrary code execution, data corruption, or denial of service with high confidentiality, integrity, and availability impacts.
Mitigation involves applying the upstream kernel patches provided in the stable repository, such as commits 1f864d9daaf622aeaa774404fd51e7d6a435b046, 699e52180f4231c257821c037ed5c99d5eb0edb8, and c1e242beb6b1efc3c286f617e8d940c8fbf2ed41. These fixes address the overflow by additionally checking the unrounded token_len value against the response length (len) before processing. Security practitioners should update affected Linux kernels promptly and monitor for systems using rxrpc, such as those with AFS or related filesystems.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25526
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix integer overflow in rxgk_verify_response() In rxgk_verify_response(), there's a potential integer overflow due to rounding up token_len before checking it, thereby allowing the length check to be bypassed. Fix…
more
this by checking the unrounded value against len too (len is limited as the response must fit in a single UDP packet).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.6
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (static analysis, fuzzing, unit tests) directly finds integer overflow defects before deployment.
Secure engineering principles require use of safe arithmetic constructs or language features that structurally eliminate integer overflow during calculation.
Input validation enforces bounds on values before arithmetic, stopping the conditions that trigger overflow or wraparound.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require use of safe arithmetic, bounds checks, and testing that prevent integer overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect integer overflows before release.
Secure coding standards explicitly forbid unsafe integer operations and mandate overflow-safe constructs.