CVE-2026-31635

Vulnerability

Overview

CVE-2026-31635 is a logic error in the Linux kernel's RxRPC (rxrpc) implementation. The function rxgk_verify_response() decodes an auth_len field from incoming RESPONSE packets and is supposed to verify that it fits within the remaining packet payload. However, the length check is inverted, so oversized authenticator lengths are accepted and passed to rxgk_decrypt_skb() [1].

Exploitation

An unauthenticated remote attacker can craft a RESPONSE packet with an auth_len value that exceeds the actual remaining data. When the kernel processes this packet, the oversized length is forwarded to rxgk_decrypt_skb(), which eventually calls skb_to_sgvec() with an impossible length, triggering a BUG_ON and causing a kernel panic [1]. No special privileges or local access are required; the attack is purely network-based against an RxRPC connection.

Impact

Successful exploitation results in a denial-of-service (DoS) condition via kernel panic. The crash trace shows the panic originates in __skb_to_sgvec() and propagates through the RxRPC connection worker thread [1]. A proof-of-concept exploit (dubbed "DirtyDecrypt") has been published, demonstrating the vulnerability [4].

Mitigation

The fix corrects the inverted length check by rejecting authenticator lengths that exceed the remaining packet payload [1][2][3]. Patches have been applied to the mainline Linux kernel and are available in stable branches. Users should update their kernels to the latest patched versions to mitigate this vulnerability.