Description
In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix integer overflow in rxgk_verify_response()

In rxgk_verify_response(), there's a potential integer overflow due to
rounding up token_len before checking it, thereby allowing the length check to
be bypassed.

Fix this by checking the unrounded value against len too (len is limited as
the response must fit in a single UDP packet).
Published: 2026-04-24
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Integer Overflow (CWE-190)
Action: Immediate Patch
AI Analysis

Impact

The Linux kernel contains an integer overflow in the rxgk_verify_response() routine of the rxrpc implementation. The overflow occurs when the code rounds up token_len before validating it against the packet length, allowing malformed packets to bypass the size check. This flaw can cause memory corruption or kernel instability when processed. The weakness is classified as CWE‑190.

Affected Systems

The vulnerability affects all Linux kernels that incorporate the unpatched rxrpc code. According to the CPE list and affected version data, kernels 6.16 and all 7.0 release candidates up to rc7 are vulnerable. Any distribution running one of these kernels without the patch is impacted.

Risk and Exploitability

The CVSS score of 9.8 marks the issue as critical, while the EPSS score of < 1 % indicates a low but non‑zero likelihood of exploitation. The vulnerability is not in the CISA KEV catalog. Based on the description, it is inferred that exploitation would be achieved remotely via a crafted UDP packet sent to the rxrpc port, leveraging the untrusted network input.

Generated by OpenCVE AI on April 28, 2026 at 13:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the kernel to a release that includes the rxrpc integer overflow fix.
  • If immediate upgrading is not possible, block or rate‑limit inbound rxrpc UDP traffic (typically port 2000) using firewall rules or network segmentation to prevent malicious packets.
  • If the system does not use the rxrpc protocol, disable it by setting the sysctl net.rpc.dgram=0 and verify that the kernel is configured accordingly.

Generated by OpenCVE AI on April 28, 2026 at 13:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Apr 2026 20:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*

Mon, 27 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sat, 25 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Fri, 24 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix integer overflow in rxgk_verify_response() In rxgk_verify_response(), there's a potential integer overflow due to rounding up token_len before checking it, thereby allowing the length check to be bypassed. Fix this by checking the unrounded value against len too (len is limited as the response must fit in a single UDP packet).
Title rxrpc: Fix integer overflow in rxgk_verify_response()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-11T22:12:35.254Z

Reserved: 2026-03-09T15:48:24.125Z

Link: CVE-2026-31633

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-04-24T15:16:42.613

Modified: 2026-04-27T20:30:33.913

Link: CVE-2026-31633

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-24T00:00:00Z

Links: CVE-2026-31633 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T14:00:16Z

Weaknesses