CVE-2026-31635

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: fix oversized RESPONSE authenticator length check

rxgk_verify_response() decodes auth_len from the packet and is supposed

to verify that it fits in the remaining bytes. The existing check is

inverted, so oversized RESPONSE authenticators are accepted and passed

to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an

impossible length and hit BUG_ON(len).

Decoded from the original latest-net reproduction logs with

scripts/decode_stacktrace.sh:

RIP: __skb_to_sgvec()

[net/core/skbuff.c:5285 (discriminator 1)]

Call Trace:

skb_to_sgvec() [net/core/skbuff.c:5305]

rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]

rxgk_verify_response() [net/rxrpc/rxgk.c:1268]

rxrpc_process_connection()

[net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364

net/rxrpc/conn_event.c:386]

process_one_work() [kernel/workqueue.c:3281]

worker_thread()

[kernel/workqueue.c:3353 kernel/workqueue.c:3440]

kthread() [kernel/kthread.c:436]

ret_from_fork() [arch/x86/kernel/process.c:164]

Reject authenticator lengths that exceed the remaining packet payload.