CyberSecBulletin
CVE-2026-31636NVD status: Analyzed

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-31636 is a critical-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 7875f3d9777bd4e9892c4db830571ab8ac2044c0, 20a188775a9a9982d1987e12660d9b44b40a6c99, 3e3138007887504ee9206d0bfb5acb062c600025 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.44% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 7875f3d9777bd4e9892c4db830571ab8ac2044c0 or 20a188775a9a9982d1987e12660d9b44b40a6c99 or 3e3138007887504ee9206d0bfb5acb062c600025, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.18.23 or 6.19.13, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a up to, but not including, 7875f3d9777bd4e9892c4db830571ab8ac2044c0; 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a up to, but not including, 20a188775a9a9982d1987e12660d9b44b40a6c99; 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a up to, but not including, 3e3138007887504ee9206d0bfb5acb062c600025; 6.167875f3d9777bd4e9892c4db830571ab8ac2044c0, 20a188775a9a9982d1987e12660d9b44b40a6c99, 3e3138007887504ee9206d0bfb5acb062c600025
LinuxLinux Kernel6.16.1 up to, but not including, 6.18.23; 6.19 up to, but not including, 6.19.13; 6.16; 7.06.18.23, 6.19.13

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator() copies auth_len bytes into a temporary buffer and then passes p + auth_len as the parser limit to rxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the parser end pointer by a factor of four and lets malformed RESPONSE authenticators read past the kmalloc() buffer. Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: BUG: KASAN: slab-out-of-bounds in rxgk_verify_response() Call Trace: dump_stack_lvl() [lib/dump_stack.c:123] print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482] kasan_report() [mm/kasan/report.c:597] rxgk_verify_response() [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167 net/rxrpc/rxgk.c:1274] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Allocated by task 54: rxgk_verify_response() [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155 net/rxrpc/rxgk.c:1274] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] Convert the byte count to __be32 units before constructing the parser limit.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.