Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator()… (CVE-2026-31636)
In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator() copies auth_len bytes into a temporary buffer and then passes p + auth_len as the parser limit to rxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the parser end pointer by a factor of four and lets malformed RESPONSE authenticators read past the kmalloc() buffer. Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: BUG: KASAN: slab-out-of-bounds in rxgk_verify_response() Call Trace: dump_stack_lvl() [lib/dump_stack.c:123] print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482] kasan_report() [mm/kasan/report.c:597] rxgk_verify_response() [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167 net/rxrpc/rxgk.c:1274] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Allocated by task 54: rxgk_verify_response() [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155 net/rxrpc/rxgk.c:1274] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] Convert the byte count to __be32 units before constructing the parser limit.
AI Analysis
Technical Summary
The advisory covers security fixes for eight CVEs affecting the Linux kernel in Red Hat Enterprise Linux 10 and its derivatives. Vulnerabilities include an out-of-bounds read in the rxrpc RESPONSE authenticator parser (CVE-2026-31636), clearing of skb2->cb[] in IPv6 ICMP error generation (CVE-2026-43038), a potential race condition in tcp_v6_syn_recv_sock() (CVE-2026-43198), a complete fix for a double free in the qla2xxx SCSI driver (CVE-2026-43414), workqueue list corruption in RDMA/iwcm (CVE-2026-45898), removal of a user-triggerable WARN_ON() in RDMA/mana (CVE-2026-46117), validation of rx_hash_key_len in RDMA/mana (CVE-2026-46145), and a race condition fix in nvmet-tcp (CVE-2026-46135). The advisory also addresses unexpected SELinux execmem denials after a prior fix. The update is rated as Important by Red Hat Product Security and requires a system reboot. Detailed patch instructions are available in the vendor advisory.
Potential Impact
These vulnerabilities affect the Linux kernel core, potentially leading to out-of-bounds memory reads, race conditions, double free errors, and kernel warnings that could impact system stability and security. The issues span multiple kernel subsystems including networking (rxrpc, ipv6, tcp), storage (scsi), and RDMA components. Exploitation could lead to denial of service or other kernel-level impacts. No known exploits in the wild have been reported. The update mitigates these risks by correcting the underlying code defects.
Mitigation Recommendations
A security update for the Linux kernel packages is available from Red Hat for Red Hat Enterprise Linux 10 and related variants. Administrators should apply the update as described in the Red Hat advisory RHSA-2026:30129 (https://access.redhat.com/errata/RHSA-2026:30129) and reboot affected systems to ensure the fixes take effect. No additional mitigation steps are indicated by the vendor advisory.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator()… (CVE-2026-31636)
Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator() copies auth_len bytes into a temporary buffer and then passes p + auth_len as the parser limit to rxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the parser end pointer by a factor of four and lets malformed RESPONSE authenticators read past the kmalloc() buffer. Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: BUG: KASAN: slab-out-of-bounds in rxgk_verify_response() Call Trace: dump_stack_lvl() [lib/dump_stack.c:123] print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482] kasan_report() [mm/kasan/report.c:597] rxgk_verify_response() [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167 net/rxrpc/rxgk.c:1274] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Allocated by task 54: rxgk_verify_response() [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155 net/rxrpc/rxgk.c:1274] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] Convert the byte count to __be32 units before constructing the parser limit.
CVSS v3.1
Score 9.1critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The advisory covers security fixes for eight CVEs affecting the Linux kernel in Red Hat Enterprise Linux 10 and its derivatives. Vulnerabilities include an out-of-bounds read in the rxrpc RESPONSE authenticator parser (CVE-2026-31636), clearing of skb2->cb[] in IPv6 ICMP error generation (CVE-2026-43038), a potential race condition in tcp_v6_syn_recv_sock() (CVE-2026-43198), a complete fix for a double free in the qla2xxx SCSI driver (CVE-2026-43414), workqueue list corruption in RDMA/iwcm (CVE-2026-45898), removal of a user-triggerable WARN_ON() in RDMA/mana (CVE-2026-46117), validation of rx_hash_key_len in RDMA/mana (CVE-2026-46145), and a race condition fix in nvmet-tcp (CVE-2026-46135). The advisory also addresses unexpected SELinux execmem denials after a prior fix. The update is rated as Important by Red Hat Product Security and requires a system reboot. Detailed patch instructions are available in the vendor advisory.
Potential Impact
These vulnerabilities affect the Linux kernel core, potentially leading to out-of-bounds memory reads, race conditions, double free errors, and kernel warnings that could impact system stability and security. The issues span multiple kernel subsystems including networking (rxrpc, ipv6, tcp), storage (scsi), and RDMA components. Exploitation could lead to denial of service or other kernel-level impacts. No known exploits in the wild have been reported. The update mitigates these risks by correcting the underlying code defects.
Mitigation Recommendations
A security update for the Linux kernel packages is available from Red Hat for Red Hat Enterprise Linux 10 and related variants. Administrators should apply the update as described in the Red Hat advisory RHSA-2026:30129 (https://access.redhat.com/errata/RHSA-2026:30129) and reboot affected systems to ensure the fixes take effect. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:30129
- Cve Count
- 8
- Additional Cves
- ["CVE-2026-43038","CVE-2026-43198","CVE-2026-43414","CVE-2026-45898","CVE-2026-46117","CVE-2026-46135","CVE-2026-46145"]
- Cvss Version
- null
Threat ID: 6a3e8056cef61ccff96ff66f
Added to database: 06/26/2026, 13:36:22 UTC
Last enriched: 07/30/2026, 15:01:21 UTC
Last updated: 08/10/2026, 00:41:15 UTC
Views: 95
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.