CVE-2026-31630rxrpc: proc: size address buffers for %pISpc output
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc". That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 75b54cb57ca34cbe7a87c6ac757c55360a624590 before 386c86412608d3449006a318a662cbcd6ca1f668; from 75b54cb57ca34cbe7a87c6ac757c55360a624590 before 235b2115de892eab2e107a42efa7a4347baaa80b; from 75b54cb57ca34cbe7a87c6ac757c55360a624590 before 625af53a1564e31bb2df9adc3739df46137f46c1; from 75b54cb57ca34cbe7a87c6ac757c55360a624590 before db297c78ce537c9ac96f0eda9b25ad72c8caefa9; 75b54cb57ca34cbe7a87c6ac757c55360a624590 builds before 10ebed83f9f6414af4e85bc85ffaeda7effdd874; from 75b54cb57ca34cbe7a87c6ac757c55360a624590 before a44ce6aa2efb61fe44f2cfab72bb01544bbca272 | CNA record |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
linux linux_kernel linux:linux_kernel | from 4.9.1 before 6.18.23; from 6.19 before 6.19.13; 4.9; 7.0; 7.0; 7.0; 7.0; 7.0; and 2 more ranges | NVD |
References
- https://git.kernel.org/stable/c/386c86412608d3449006a318a662cbcd6ca1f668
- https://git.kernel.org/stable/c/235b2115de892eab2e107a42efa7a4347baaa80b
- https://git.kernel.org/stable/c/625af53a1564e31bb2df9adc3739df46137f46c1
- https://git.kernel.org/stable/c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9patch
- https://git.kernel.org/stable/c/10ebed83f9f6414af4e85bc85ffaeda7effdd874patch
- https://git.kernel.org/stable/c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272patch
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.