Log in Start free

Vulnerability · Published Apr 24, 2026 · Assigned by Linux

CVE-2026-31633rxrpc: Fix integer overflow in rxgk_verify_response()

Critical 9.8

In plain English

A critical-severity integer overflow in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 59.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix integer overflow in rxgk_verify_response() In rxgk_verify_response(), there's a potential integer overflow due to rounding up token_len before checking it, thereby allowing the length check to be bypassed. Fix this by checking the unrounded value against len too (len is limited as the response must fit in a single UDP packet).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14linux6.19.13-1DEBIAN-CVE-2026-31633
Ubuntu:25.10linuxno fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-31633
Ubuntu:25.10linux-awsno fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-31633
Ubuntu:25.10linux-azureno fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-azure-6.176.17.0-1022.22UBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-azure-6.176.17.0-1022.22USN-8636-1
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-31633
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-31633
Ubuntu:25.10linux-gcpno fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1022.25USN-8636-1
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1022.25UBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-hwe-6.176.17.0-42.42USN-8636-1
Ubuntu:24.04:LTSlinux-hwe-6.176.17.0-42.42UBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-31633
Ubuntu:26.04:LTSlinux-nvidia7.0.0-1006.6UBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-nvidia-6.176.17.0-1031.31UBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1032.32UBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1032.32USN-8636-1
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-31633
Ubuntu:25.10linux-oracleno fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1020.20UBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1020.20USN-8636-2
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-31633
Ubuntu:25.10linux-raspino fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-31633
Ubuntu:25.10linux-realtimeno fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-31633
Ubuntu:25.10linux-riscvno fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-31633
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-31633
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-31633

Affected products (as reported)

VendorProductVersions
Linux Linux 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a – before 1f864d9daaf622aeaa774404fd51e7d6a435b0469d1d2b59341f58126a69b51f9f5f8ccb9f12e54a – before c1e242beb6b1efc3c286f617e8d940c8fbf2ed419d1d2b59341f58126a69b51f9f5f8ccb9f12e54a – before 699e52180f4231c257821c037ed5c99d5eb0edb8
Linux Linux 6.16

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References