CVE-2026-31630

Vulnerability

The AF_RXRPC procfs helpers in the Linux kernel format local and remote socket addresses into fixed 50-byte stack buffers using the "%pISpc" format specifier. This buffer size is insufficient for the longest possible IPv6-with-port representation the formatter can produce, such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535, which is 50 characters plus a trailing NUL (51 bytes total). The compressed IPv6 path generates such strings for ISATAP addresses, exceeding the 50-byte limit and causing a stack buffer overflow [1].

Exploitation

The vulnerability is present in net/rxrpc/proc.c and can be triggered by local users or processes with access to the rxrpc procfs interface. No special privileges beyond being able to read/write the procfs entries are required, as the overflow occurs during normal formatting of network addresses stored in kernel structures. An attacker cannot directly control the content that overflows, but the overflow can corrupt adjacent stack data, potentially leading to control-flow hijack.

Impact

A successful exploit may overwrite stack memory, enabling local privilege escalation or kernel crash (denial of service). Given the CVSS score of 7.8, the impact is considered high, with low attack complexity and no user interaction required beyond local access.

Mitigation

The fix sizes the buffers to accommodate the maximum textual form and switches the call sites to scnprintf() to prevent overflows. Patches are available in the Linux stable repository for affected kernel versions [1][2][3]. System administrators should apply the latest kernel updates to address this CVE.