CVE-2026-31636

A flaw was found in the Linux kernel's rxrpc subsystem. A remote attacker could send a specially crafted rxrpc RESPONSE authenticator that, due to an incorrect parser limit calculation in the rxgk_verify_authenticator() function, leads to a slab-out-of-bounds read. This memory corruption vulnerability could result in information disclosure or a denial of service.

A moderate severity out-of-bounds read flaw was found in the Linux kernel rxrpc subsystem's rxgk security class. When the yfs-rxgk (GSSAPI) security class is in use, a remote attacker could send a specially crafted rxrpc RESPONSE authenticator that is parsed with an incorrect limit in rxgk_verify_authenticator(): a byte count is added to a __be32 pointer without converting it to __be32 units, inflating the parser end pointer by a factor of four and allowing a slab-out-of-bounds read past the allocated kmalloc buffer. This could result in information disclosure from kernel memory or a denial of service via kernel crash. The vulnerable code was introduced together with the yfs-rxgk security class implementation and is present only in Red Hat Enterprise Linux 10.2 and 10.3 and in Red Hat In-Vehicle OS 2; earlier Red Hat Enterprise Linux streams do not contain the vulnerable code and are therefore not affected. Fixes for the affected products are being pursued through the delegated kernel maintenance process. The upstream CVE record rates this flaw as critical (CVSS 9.1, network attack vector); Red Hat assesses it as moderate severity based on Red Hat's CVSS 3.1 vector (7.1, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.