CVE-2026-31630: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31630 is a stack buffer overflow vulnerability in the Linux kernel's AF_RXRPC procfs interface, specifically in net/rxrpc/proc.c. The flaw arises because local and remote socket addresses are formatted into fixed 50-byte stack buffers using the %pISpc format specifier, which can produce IPv6-with-port strings up to 51 bytes (e.g., [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535), overflowing the buffer. Affected versions span Linux kernel 4.9.1 through 6.18.22, 6.19 through 6.19.12, and 7.0-rc1 through 7.0-rc7. It was published on April 24, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incorrect calculation of buffer size (CWE-131) in net/rxrpc/proc.c, where char[50] stack buffers are used to hold formatted socket addresses. The %pISpc kernel format specifier in lib/vsprintf.c can produce ISATAP IPv6 addresses with a dotted-quad tail (e.g., [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535), which is 50 visible characters plus a null terminator — one byte more than the buffer can hold. A local attacker with low privileges can trigger this overflow by causing the procfs interface to render such an address, potentially corrupting adjacent kernel stack memory. The fix involves sizing buffers from the formatter's maximum textual output and switching call sites to scnprintf() (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation of this vulnerability can result in kernel memory corruption, potentially enabling a local low-privileged attacker to escalate privileges to root, execute arbitrary code in kernel context, or cause a system crash (denial of service). The vulnerability is particularly concerning on multi-user systems where untrusted local users may interact with the AF_RXRPC subsystem via procfs. Confidentiality, integrity, and availability are all rated High in the CVSS assessment (GitHub Advisory).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015–0.017%, placing it in a low percentile for near-term exploitation likelihood. Exploitation requires local access with low privileges, limiting the attack surface compared to remotely exploitable vulnerabilities.

Patches are available via the following upstream kernel commits: 10ebed83f9f6414af4e85bc85ffaeda7effdd874, a44ce6aa2efb61fe44f2cfab72bb01544bbca272, and db297c78ce537c9ac96f0eda9b25ad72c8caefa9. Administrators should update to Linux kernel 6.18.23 or later (for 6.18.x branches), 6.19.13 or later (for 6.19.x branches), or await the 7.0 stable release. As interim mitigations, restrict unprivileged access to /proc/net via file permissions or SELinux/AppArmor policies, and ensure kernel hardening features such as SMEP and SMAP are enabled to reduce the impact of potential exploitation (GitHub Advisory, Red Hat Bugzilla).

Red Hat tracked the issue via Bugzilla (Bug 2461545) and rated it medium severity. The Yocto Project security mailing list and Slackware Linux (SSA-2026-152-01) issued advisories referencing this CVE as part of broader kernel security updates. Community discussion on Reddit's r/slackware noted the kernel update inclusion. No significant independent researcher commentary or media coverage beyond standard vulnerability tracking has been observed.