CVE-2026-31635
Linux Kernel 6.16.1 – 6.18.23
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-31635 is a high-severity Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-31635 is a vulnerability in the Linux kernel's RxRPC implementation, specifically in the rxgk_verify_response() function within the rxrpc module. The issue stems from an inverted check on the decoded authenticator length (auth_len), which fails to properly verify that it fits within the remaining packet bytes. As a result, oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt_skb(), potentially leading to an invalid length in skb_to_sgvec() and triggering a BUG_ON(len) kernel crash. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a crafted RxRPC packet with an oversized authenticator length, the attacker triggers the inverted check, causing the kernel workqueue processing to reach the BUG_ON in skbuff.c, resulting in a kernel panic and denial of service. The impact is limited to availability disruption, with no confidentiality or integrity effects.
The provided kernel stable commit references detail the fix: commits a2567217ade970ecc458144b6be469bc015b23e5, beee051f259acd286fed64c32c2b31e6f5097eb5, and e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305 reject authenticator lengths exceeding the remaining packet payload, preventing the oversized values from propagating to decryption routines. Security practitioners should apply these patches to affected Linux kernel versions supporting RxRPC.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25528
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted,…
more
so oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an impossible length and hit BUG_ON(len). Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: RIP: __skb_to_sgvec() [net/core/skbuff.c:5285 (discriminator 1)] Call Trace: skb_to_sgvec() [net/core/skbuff.c:5305] rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81] rxgk_verify_response() [net/rxrpc/rxgk.c:1268] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Reject authenticator lengths that exceed the remaining packet payload.
- CWE(s)
Related Threats
Threat-Actor AttributionAI
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.5.5V4.2.1V4.2.2
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover length-parameter inconsistencies through targeted parsing tests.
Input validation enforces correct length-to-data consistency checks on parsed messages before processing.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce length validation and input sanitization during coding and review.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect length-inconsistency vulnerabilities before deployment.
Secure development lifecycle mandates input validation and length checks that directly address inconsistent length fields.
Application security requirements include explicit rules for handling message lengths and data structures.
Secure architecture principles require robust parsing and bounds checking to prevent length-related flaws.
Secure coding standards directly prohibit improper length handling and enforce defensive parsing practices.