CVE-2026-31637: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31637 is a cryptographic validation bypass vulnerability in the Linux kernel's rxkad authentication subsystem, specifically in the rxkad_decrypt_ticket() function. The function decrypts RXKAD response tickets but fails to verify whether crypto_skcipher_decrypt() succeeded before parsing the resulting buffer as plaintext, allowing an attacker to inject attacker-controlled bytes into the ticket parser. Affected versions span Linux kernel 2.6.22 through 6.6.134, 6.7 through 6.12.81, 6.13 through 6.18.22, and 6.19 through 6.19.12, as well as pre-release 7.0 release candidates. It was disclosed on April 24, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an unchecked return value (CWE-252): rxkad_decrypt_ticket() calls crypto_skcipher_decrypt() but does not inspect its return code before proceeding to parse the decrypted buffer as trusted plaintext. An attacker can craft a malformed RXKAD RESPONSE packet with a non-block-aligned ticket length, which causes the decryption operation to fail internally while the function continues to parse the unmodified, attacker-controlled buffer. This effectively bypasses the cryptographic protection of the ticket, allowing arbitrary data to be fed into the ticket parsing logic. The fix checks the decrypt result and aborts the connection with RXKADBADTICKET when decryption fails (GitHub Advisory, Kernel Patch).

Successful exploitation could allow an unauthenticated remote attacker to bypass rxkad-based authentication, potentially gaining unauthorized access to services protected by this mechanism. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, meaning an attacker could read sensitive data, modify system state, or cause denial of service conditions in systems relying on rxkad for authentication. The vulnerability is network-exploitable with no privileges or user interaction required, broadening the attack surface to any system exposing rxkad-authenticated services (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). No threat actor attribution has been reported. The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify Linux systems running rxkad-authenticated services (e.g., AFS file servers) that are reachable over the network and running a vulnerable kernel version (2.6.22–6.6.134, 6.7–6.12.81, 6.13–6.18.22, or 6.19–6.19.12).
2. Craft malformed RESPONSE packet: Construct an RXKAD RESPONSE packet with a ticket whose length is not aligned to the cipher block size (e.g., not a multiple of 8 bytes for DES-based rxkad), which will cause crypto_skcipher_decrypt() to return an error.
3. Inject attacker-controlled ticket data: Populate the ticket buffer with arbitrary bytes designed to be parsed by the ticket parser as if they were valid decrypted ticket content, since the return value of decryption is not checked.
4. Drive ticket parser: Send the crafted packet to the target; the kernel's rxkad_decrypt_ticket() will proceed to parse the attacker-controlled buffer, potentially leading to authentication bypass or memory corruption depending on parser behavior.
5. Achieve objective: Depending on the parser's handling of the injected data, the attacker may bypass authentication checks, gain unauthorized access to rxkad-protected resources, or trigger denial of service (GitHub Advisory).

• Network: Unexpected or malformed RXKAD RESPONSE packets with non-block-aligned ticket lengths sent to AFS or other rxkad-authenticated service ports; unusual connection attempts to rxkad service ports from untrusted sources.
• Logs: Kernel log entries (dmesg or /var/log/kern.log) showing RXKADBADTICKET errors or unexpected rxrpc connection aborts; repeated failed authentication attempts in AFS server logs.
• Process: Anomalous behavior in processes handling rxkad authentication, such as unexpected crashes or restarts of AFS-related daemons (afsd, kaserver).

Upgrade the Linux kernel to a patched version: 6.6.135 or later (for the 6.6.x LTS branch), 6.12.82 or later (for the 6.12.x branch), 6.18.23 or later (for the 6.18.x branch), 6.19.13 or later (for the 6.19.x branch), or 7.0 stable. Patch commits are available at git.kernel.org for each stable branch. As a temporary workaround for systems that cannot be immediately upgraded, restrict network access to services using rxkad authentication and monitor for anomalous RXKAD RESPONSE traffic (GitHub Advisory, Kernel Patch).

The vulnerability was noted in Slackware Linux security advisories (SSA-2026-152-01) and covered by Linux-focused community sites including linuxcompatible.org and pro-linux.de in the context of kernel security updates. A Reddit thread in r/slackware discussed the inclusion of the kernel fix in Slackware 15.0 changelogs. No major vendor statements or prominent researcher commentary beyond standard patch tracking have been observed (Slackware Advisory).