CVE-2026-31637

A flaw was found in the Linux kernel's rxrpc subsystem. A remote attacker could exploit this by sending a malformed RXKAD response ticket. This ticket, with a non-block-aligned length, would cause decryption to fail, yet the system would proceed to process attacker-controlled data. This could lead to a denial of service, causing the connection to be aborted.

Malformed RXKAD tickets that cannot decrypt are now rejected instead of confusing later crypto paths. Red Hat classifies this as rxrpc hardening against untrusted peers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.