Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded. A malformed RESPONSE can therefore use a non-block-aligned ticket length, make the decrypt operation fail, and still drive the ticket parser with attacker-controlled bytes. Check the decrypt result and abort the connection with RXKADBADTICKET when ticket decryption fails.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 2.6.22.1, < 6.6.135 |
References
- https://git.kernel.org/stable/c/22f6258e7b31dba9bf88dce4e3ee7f0f20072e60Patch
- https://git.kernel.org/stable/c/47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8aPatch
- https://git.kernel.org/stable/c/58fcd1b156152613ba00a064a129fb69507ddd7dPatch
- https://git.kernel.org/stable/c/a149dcae23309df9de1c3b6b5d468610ef5ab7dePatch
- https://git.kernel.org/stable/c/fe4447cd95623b1cfacc15f280aab73a6d7340b2Patch
FAQ
What is CVE-2026-31637?
CVE-2026-31637 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the b...
How severe is CVE-2026-31637?
CVE-2026-31637 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-31637?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.