{
  "threat_severity" : "Moderate",
  "public_date" : "2026-04-24T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: rxrpc: fix RESPONSE authenticator parser OOB read",
    "id" : "2461510",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2461510"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-805",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nrxrpc: fix RESPONSE authenticator parser OOB read\nrxgk_verify_authenticator() copies auth_len bytes into a temporary\nbuffer and then passes p + auth_len as the parser limit to\nrxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the\nparser end pointer by a factor of four and lets malformed RESPONSE\nauthenticators read past the kmalloc() buffer.\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\nBUG: KASAN: slab-out-of-bounds in rxgk_verify_response()\nCall Trace:\ndump_stack_lvl() [lib/dump_stack.c:123]\nprint_report() [mm/kasan/report.c:379 mm/kasan/report.c:482]\nkasan_report() [mm/kasan/report.c:597]\nrxgk_verify_response()\n[net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167\nnet/rxrpc/rxgk.c:1274]\nrxrpc_process_connection()\n[net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\nnet/rxrpc/conn_event.c:386]\nprocess_one_work() [kernel/workqueue.c:3281]\nworker_thread()\n[kernel/workqueue.c:3353 kernel/workqueue.c:3440]\nkthread() [kernel/kthread.c:436]\nret_from_fork() [arch/x86/kernel/process.c:164]\nAllocated by task 54:\nrxgk_verify_response()\n[include/linux/slab.h:954 net/rxrpc/rxgk.c:1155\nnet/rxrpc/rxgk.c:1274]\nrxrpc_process_connection()\n[net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\nnet/rxrpc/conn_event.c:386]\nConvert the byte count to __be32 units before constructing the parser\nlimit.", "A flaw was found in the Linux kernel's rxrpc subsystem. A remote attacker could send a specially crafted rxrpc RESPONSE authenticator that, due to an incorrect parser limit calculation in the rxgk_verify_authenticator() function, leads to a slab-out-of-bounds read. This memory corruption vulnerability could result in information disclosure or a denial of service." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-06-25T00:00:00Z",
    "advisory" : "RHSA-2026:30129",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.28.1.el10_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-31636\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31636\nhttps://lore.kernel.org/linux-cve-announce/2026042455-CVE-2026-31636-2951@gregkh/T" ],
  "name" : "CVE-2026-31636",
  "csaw" : false
}