CVE-2026-31641
type: TechArticle
description: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length from the XDR token as u32 values and passes each through round_up(x, 4) before using the rounded value for validation and allocation. When the raw length is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and kzalloc both use 0 while the subsequent memcpy still copies the original ~4 GiB value, producing a heap buffer overflow reachable from an unprivileged add_key() call. Fix this by: (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX. (2) Sizing the flexible-array allocation from the validated raw key length via struct_size_t() instead of the rounded value. (3) Caching the raw lengths so that the later field a
date published: 2026-04-24T15:16:43.463
license: https://creativecommons.org/publicdomain/zero/1.0/
source: https://nvd.nist.gov/vuln/detail/CVE-2026-31641
publisher: AI Analytics
source organization: NIST National Vulnerability Database
main entity: Thing
  additional type: Vulnerability
  score: 7.8
  severity: HIGH
keywords: CWE-125

AI Analytics
type: Organization