CVE-2026-31637

CriticalCVSS 9.8/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: reject undecryptable rxkad response tickets

rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded.

A malformed RESPONSE can therefore use a non-block-aligned ticket length, make the decrypt operation fail, and still drive the ticket parser with attacker-controlled bytes.

Check the decrypt result and abort the connection with RXKADBADTICKET when ticket decryption fails.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-754

Affected software

VendorProductVersions
LinuxLinux>= 17926a79320afa9b95df6b977b40cca6d8713cea, < 252157d939d179b5d767cb860ff8fa7f8723b67a; >= 17926a79320afa9b95df6b977b40cca6d8713cea, < a75b3b361dd481d942c5f259a82d59718a41092c; >= 17926a79320afa9b95df6b977b40cca6d8713cea, < b3a808cd0790b5075aaa2bc3588edf02cd71d352; >= 17926a79320afa9b95df6b977b40cca6d8713cea, < 47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8a; >= 17926a79320afa9b95df6b977b40cca6d8713cea, < a149dcae23309df9de1c3b6b5d468610ef5ab7de; >= 17926a79320afa9b95df6b977b40cca6d8713cea, < 22f6258e7b31dba9bf88dce4e3ee7f0f20072e60; >= 17926a79320afa9b95df6b977b40cca6d8713cea, < 58fcd1b156152613ba00a064a129fb69507ddd7d; >= 17926a79320afa9b95df6b977b40cca6d8713cea, < fe4447cd95623b1cfacc15f280aab73a6d7340b2
LinuxLinux2.6.22
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *

References

Timeline

Published
Apr 24, 2026
Last modified
Nov 11, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-316387.5In the Linux kernel, the following vulnerability has been resolved: rxrpc: Only put the call ref if one was acquired rxrpc_input_packet_onCVE-2026-316395.5In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix key reference count leak from call->key When creating a cliCVE-2026-31649.8A vulnerability was found in itsourcecode News Portal Project 1.0. This issue affects some unknown processing of the file /admin/contactus.pCVE-2026-316407.5In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix use of wrong skb when comparing queued RESP challenge serialCVE-2026-316417.8In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rCVE-2026-316425.5In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call removal to use RCU safe deletion Fix rxrpc call removaCVE-2026-316435.5In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix key parsing memleak In rxrpc_preparse_xdr_yfs_rxgk(), the mCVE-2026-316447.8In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() WheCVE-2026-316455.5In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix page pool leak in error paths lan966x_fdma_rx_alloc(CVE-2026-316465.5In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_pagCVE-2026-316475.5In the Linux kernel, the following vulnerability has been resolved: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling SwiCVE-2026-316487.8In the Linux kernel, the following vulnerability has been resolved: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
CVE-2026-31637: Critical severity, CVSS 9.8 | Vulnix