Linux Kernel up to 6.18.22/6.19.12 rxrpc_preparse_xdr_yfs_rxgk toctou

Summaryinfo

A vulnerability labeled as critical has been found in Linux Kernel up to 6.18.22/6.19.12. This issue affects the function rxrpc_preparse_xdr_yfs_rxgk. The manipulation results in toctou. This vulnerability was named CVE-2026-31641. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.22/6.19.12. Affected is the function rxrpc_preparse_xdr_yfs_rxgk. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length from the XDR token as u32 values and passes each through round_up(x, 4) before using the rounded value for validation and allocation. When the raw length is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and kzalloc both use 0 while the subsequent memcpy still copies the original ~4 GiB value, producing a heap buffer overflow reachable from an unprivileged add_key() call. Fix this by: (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX. (2) Sizing the flexible-array allocation from the validated raw key length via struct_size_t() instead of the rounded value. (3) Caching the raw lengths so that the later field assignments and memcpy calls do not re-read from the token, eliminating a class of TOCTOU re-parse. The control path (valid token with lengths within bounds) is unaffected.

The advisory is available at git.kernel.org. This vulnerability is traded as CVE-2026-31641 since 03/09/2026. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 310512 (Linux Distros Unpatched Vulnerability : CVE-2026-31641), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.23 or 6.19.13 eliminates this vulnerability. Applying the patch 3e04596cba8a86cbff9c3f4bf0a524a3a488773c/49875b360c2b83a3c226e189c502e501d83e6445/d179a868dd755b0cfcf7582e00943d702b9943b8 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (310512) and CERT Bund (WID-SEC-2026-1279). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Google Container-Optimized OS
• Debian Linux
• Red Hat Enterprise Linux
• Oracle Linux
• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.18.16
• 6.18.17
• 6.18.18
• 6.18.19
• 6.18.20
• 6.18.21
• 6.18.22
• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3
• 6.19.4
• 6.19.5
• 6.19.6
• 6.19.7
• 6.19.8
• 6.19.9
• 6.19.10
• 6.19.11
• 6.19.12

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion