VDB
CVE-2026-31637
CVE-2026-31637
PUBLISHED
In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded. A malformed RESPONSE can therefore use a non-block-aligned ticket length, make the decrypt operation fail, and still drive the ticket parser with attacker-controlled bytes. Check the decrypt result and abort the connection with RXKADBADTICKET when ticket decryption fails.
EPSS 0.10% · 26.7th percentile
Risk Scores
EPSS Score
0.10%
26.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| linux | linux_kernel | 2.6.22, 2.6.22, 2.6.22 |
| Linux | Linux | 17926a79320afa9b95df6b977b40cca6d8713cea, 17926a79320afa9b95df6b977b40cca6d8713cea, 17926a79320afa9b95df6b977b40cca6d8713cea |
Timeline
- Apr 24, 2026 CVE Published
- Apr 24, 2026 Security Advisory
- Apr 27, 2026 Security Advisory
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score
- May 26, 2026 EPSS Score
References
- https://git.kernel.org/stable/c/47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8a url
- https://git.kernel.org/stable/c/a149dcae23309df9de1c3b6b5d468610ef5ab7de url
- https://git.kernel.org/stable/c/22f6258e7b31dba9bf88dce4e3ee7f0f20072e60 url
- https://git.kernel.org/stable/c/58fcd1b156152613ba00a064a129fb69507ddd7d url
- https://git.kernel.org/stable/c/fe4447cd95623b1cfacc15f280aab73a6d7340b2 url
- https://nvd.nist.gov/vuln/detail/CVE-2026-31637 advisory
- https://lists.debian.org/debian-security-announce/2026/msg00154.html advisory
- https://lists.debian.org/debian-security-announce/2026/msg00148.html advisory