CVE-2026-31637rxrpc: reject undecryptable rxkad response tickets
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded. A malformed RESPONSE can therefore use a non-block-aligned ticket length, make the decrypt operation fail, and still drive the ticket parser with attacker-controlled bytes. Check the decrypt result and abort the connection with RXKADBADTICKET when ticket decryption fails.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 17926a79320afa9b95df6b977b40cca6d8713cea before 252157d939d179b5d767cb860ff8fa7f8723b67a; from 17926a79320afa9b95df6b977b40cca6d8713cea before a75b3b361dd481d942c5f259a82d59718a41092c; from 17926a79320afa9b95df6b977b40cca6d8713cea before b3a808cd0790b5075aaa2bc3588edf02cd71d352; from 17926a79320afa9b95df6b977b40cca6d8713cea before 47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8a; from 17926a79320afa9b95df6b977b40cca6d8713cea before a149dcae23309df9de1c3b6b5d468610ef5ab7de; 17926a79320afa9b95df6b977b40cca6d8713cea builds before 22f6258e7b31dba9bf88dce4e3ee7f0f20072e60; 17926a79320afa9b95df6b977b40cca6d8713cea builds before 58fcd1b156152613ba00a064a129fb69507ddd7d; from 17926a79320afa9b95df6b977b40cca6d8713cea before fe4447cd95623b1cfacc15f280aab73a6d7340b2 | CNA record |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
linux linux_kernel linux:linux_kernel | from 2.6.22.1 before 6.6.135; from 6.7 before 6.12.82; from 6.13 before 6.18.23; from 6.19 before 6.19.13; 2.6.22; 7.0; 7.0; 7.0; and 4 more ranges | NVD |
References
- https://git.kernel.org/stable/c/252157d939d179b5d767cb860ff8fa7f8723b67a
- https://git.kernel.org/stable/c/a75b3b361dd481d942c5f259a82d59718a41092c
- https://git.kernel.org/stable/c/b3a808cd0790b5075aaa2bc3588edf02cd71d352
- https://git.kernel.org/stable/c/47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8apatch
- https://git.kernel.org/stable/c/a149dcae23309df9de1c3b6b5d468610ef5ab7depatch
- https://git.kernel.org/stable/c/22f6258e7b31dba9bf88dce4e3ee7f0f20072e60patch
- https://git.kernel.org/stable/c/58fcd1b156152613ba00a064a129fb69507ddd7dpatch
- https://git.kernel.org/stable/c/fe4447cd95623b1cfacc15f280aab73a6d7340b2patch
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.