CVE-2026-31636: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31636 is an out-of-bounds read vulnerability in the Linux kernel's rxrpc subsystem, specifically in the rxgk_verify_authenticator() function responsible for parsing RESPONSE authenticators. The flaw allows unauthenticated remote attackers to read past a kmalloc() buffer boundary by sending malformed RESPONSE authenticators. Affected Linux kernel versions include 6.16, 6.16.1 through 6.18.22, 6.19 through 6.19.12, and 7.0-rc1 through 7.0-rc7. It was published on April 24, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory).

The root cause is a pointer arithmetic unit conversion error (CWE-125: Out-of-bounds Read). In rxgk_verify_authenticator(), auth_len bytes are copied into a temporary buffer, and then p + auth_len is passed as the parser limit to rxgk_do_verify_authenticator(). Because p is a __be32 * pointer, C pointer arithmetic multiplies the offset by sizeof(__be32) (4 bytes), inflating the parser end pointer by a factor of four beyond the actual allocated buffer. This allows a malformed RESPONSE authenticator to cause the parser to read up to four times further than intended past the kmalloc() buffer boundary. The fix converts the byte count to __be32 units before constructing the parser limit. KASAN reports this as a slab-out-of-bounds read in rxgk_verify_response() (GitHub Advisory).

Successful exploitation can result in disclosure of sensitive kernel memory contents (high confidentiality impact) or denial of service via kernel crash (high availability impact). Because the vulnerability is reachable over the network without authentication or user interaction, an attacker can trigger it remotely by sending a crafted RESPONSE authenticator to any system with the rxrpc subsystem active. There is no integrity impact, but kernel memory disclosure could expose cryptographic material, credentials, or other sensitive data that could facilitate further attacks (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.017% (0.000170), placing it in the 18th percentile for exploitation probability within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection coverage exists via Nessus plugin 310428.

• Logs: KASAN kernel log entries containing BUG: KASAN: slab-out-of-bounds in rxgk_verify_response() in the system journal or /var/log/kern.log.
• Logs: Kernel stack traces referencing rxgk_verify_response(), rxrpc_process_connection(), and process_one_work() in kernel logs.
• Network: Unexpected or malformed rxrpc RESPONSE packets received on systems not expected to use the rxrpc/AFS protocol.
• Process: Kernel worker thread crashes or unexpected system reboots on systems running affected kernel versions with rxrpc enabled.

Update to patched Linux kernel versions 6.18.23 or later, or 6.19.13 or later. The fixes are available in three stable-branch commits: 20a188775a9a9982d1987e12660d9b44b40a6c99, 3e3138007887504ee9206d0bfb5acb062c600025, and 7875f3d9777bd4e9892c4db830571ab8ac2044c0 (GitHub Advisory). As a network-level workaround where immediate patching is not feasible, restrict untrusted rxrpc traffic at the firewall or network perimeter. Monitor kernel logs for KASAN warnings related to rxgk_verify_response() as an interim detection measure.