CVE-2026-31641 Overview
CVE-2026-31641 is a heap buffer overflow in the Linux kernel's rxrpc subsystem, specifically in the RxGK token loading path. The flaw resides in rxrpc_preparse_xdr_yfs_rxgk(), which processes XDR-encoded authentication tokens supplied through the unprivileged add_key() system call. An integer wraparound in round_up(x, 4) allows an attacker to trigger an undersized kernel allocation followed by a multi-gigabyte memcpy, corrupting kernel heap memory. The vulnerability is classified as an Out-of-Bounds Write [CWE-125] and affects Linux kernel 6.16 and 7.0 release candidates.
Critical Impact
A local, unprivileged user can trigger a heap buffer overflow in kernel memory via add_key(), leading to kernel memory corruption, privilege escalation, or system compromise.
Affected Products
- Linux kernel 6.16
- Linux kernel 7.0-rc1 through 7.0-rc7
- Distributions shipping the rxrpc module with RxGK (YFS) token support
Discovery Timeline
- 2026-04-24 - CVE-2026-31641 published to NVD
- 2026-04-27 - Last updated in NVD database
Technical Details for CVE-2026-31641
Vulnerability Analysis
The rxrpc subsystem implements RPC over the AFS file system protocol. The RxGK authentication scheme uses XDR-encoded tokens containing a raw key and a ticket, each prefixed with a u32 length field. The function rxrpc_preparse_xdr_yfs_rxgk() reads these length fields directly from user-supplied data and applies round_up(x, 4) to align them to a 4-byte boundary.
When the raw length value is at or above 0xfffffffd, the round_up() macro overflows the 32-bit space and wraps to zero. The kernel then performs its bounds check and kzalloc() allocation using the rounded value of zero. However, the subsequent memcpy() still uses the original near-4 GiB length, writing far beyond the allocated buffer into adjacent kernel heap memory.
Root Cause
The root cause is a missing bounds check before integer rounding. The RxKAD code path enforces AFSTOKEN_RK_TIX_MAX as a cap, but the RxGK path did not enforce equivalent AFSTOKEN_GK_KEY_MAX and AFSTOKEN_GK_TOKEN_MAX limits. Additionally, the code re-read length fields from the token after validation, introducing a Time-of-Check Time-of-Use (TOCTOU) reparse risk.
Attack Vector
Exploitation requires local access with the ability to call add_key(), which is available to unprivileged users by default on most distributions. An attacker crafts a malicious XDR-encoded YFS RxGK token where the key length or ticket length field is set to a value greater than or equal to 0xfffffffd. Submitting this token via add_key() triggers the wraparound, the undersized allocation, and the oversized copy. The resulting heap corruption can be shaped to overwrite kernel structures and achieve privilege escalation.
No public proof-of-concept exploit is available. See the upstream fix commit for the corrected validation logic.
Detection Methods for CVE-2026-31641
Indicators of Compromise
- Unexpected add_key() invocations with rxrpc or yfs_rxgk key types from non-administrative users
- Kernel oops or panic messages referencing rxrpc_preparse_xdr_yfs_rxgk or heap corruption in kmalloc slabs
- Sudden privilege transitions for processes that previously held only user-level credentials
- KASAN reports flagging slab-out-of-bounds writes originating in the rxrpc keyring path
Detection Strategies
- Audit add_key syscalls via auditd with rules targeting key types rxrpc and rxrpc_s
- Enable KASAN on test and staging kernels to surface heap overflows during fuzzing or runtime
- Monitor dmesg for kernel warnings tied to rxrpc token parsing failures or unusual allocation sizes
- Use eBPF tracing on keyctl_instantiate_key and related entry points to flag oversized token payloads
Monitoring Recommendations
- Forward kernel logs and audit records to a centralized analytics platform for correlation across hosts
- Establish baselines for legitimate rxrpc usage in environments running AFS or kAFS clients
- Alert on processes spawning shells or modifying SUID binaries shortly after add_key() calls
- Track loaded kernel modules to confirm whether rxrpc is loaded on systems that do not require it
How to Mitigate CVE-2026-31641
Immediate Actions Required
- Apply the upstream patches referenced by commits 3e04596c, 49875b36, and d179a868 from kernel.org
- Inventory all systems running Linux kernel 6.16 or 7.0 release candidates and prioritize patching
- Blacklist the rxrpc module on systems that do not use AFS or kAFS to remove the attack surface
- Restrict add_key() access through seccomp filters for untrusted workloads and containers
Patch Information
The Linux kernel maintainers released fixes in three commits: 3e04596c, 49875b36, and d179a868. The patches reject raw key lengths exceeding AFSTOKEN_GK_KEY_MAX and ticket lengths exceeding AFSTOKEN_GK_TOKEN_MAX before rounding, use struct_size_t() for allocation sizing based on validated lengths, and cache raw lengths to prevent token reparsing.
Workarounds
- Unload and blacklist the rxrpc kernel module if AFS protocols are not required: echo 'blacklist rxrpc' > /etc/modprobe.d/rxrpc.conf
- Apply seccomp policies that deny the add_key and keyctl syscalls for containerized or sandboxed workloads
- Restrict access to the kernel keyring subsystem through user namespace and capability hardening
- Deploy SELinux or AppArmor profiles that block unprivileged keyring operations on production servers
# Configuration example: blacklist the rxrpc module
echo 'blacklist rxrpc' | sudo tee /etc/modprobe.d/rxrpc-blacklist.conf
sudo rmmod rxrpc 2>/dev/null
sudo update-initramfs -u
# Verify the module is not loaded
lsmod | grep rxrpc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
