CVE-2026-31640: Missing Release of Memory after Effective Lifetime

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial In rxrpcpostresponse, the code should be comparing the challenge serial number from the cached response before deciding to switch to a newer response, but...

CVE-2026-31636: Out-of-bounds Read

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgkverifyauthenticator copies authlen bytes into a temporary buffer and then passes p + authlen as the parser limit to rxgkdoverifyauthenticator. Since p is a be32 , that inflate...

CVE-2026-31630: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AFRXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc". That is too small for the longest current-tree IPv6-with-port...

CVE-2026-31635: Improper Handling of Length Parameter Inconsistency

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgkverifyresponse decodes authlen from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE...

CVE-2026-31633: Integer Overflow or Wraparound

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix integer overflow in rxgkverifyresponse In rxgkverifyresponse, there's a potential integer overflow due to rounding up tokenlen before checking it, thereby allowing the length check to be bypassed. Fix this by checking...

CVE-2026-31637: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkaddecryptticket decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether cryptoskcipherdecrypt succeeded. A malformed RESPONSE can...

CVE-2026-31641: Out-of-bounds Read

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpcpreparsexdryfsrxgk reads the raw key length and ticket length from the XDR token as u32 values and passes each through roundupx, 4 before using the rounded value for validation a...

CVE-2026-31643: Missing Release of Memory after Effective Lifetime

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix key parsing memleak In rxrpcpreparsexdryfsrxgk, the memory attached to token-rxgk can be leaked in a few error paths after it's allocated. Fix this by freeing it in the "rejecttoken:" case...

CVE-2026-31639: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix key reference count leak from call-key When creating a client call in rxrpcallocclientcall, the code obtains a reference to the key. This is never cleaned up and gets leaked when the call is destroyed. Fix this by...

kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg

A flaw was found in the Linux kernel. A local unprivileged process can exploit an unsafe requeue path in the rxrpcrecvmsg function by using AFRXRPC sockets with MSGDONTWAIT and MSGPEEK flags. This improper handling of the receive message queue can lead to memory corruption, such as Use-After-Free...

RHEL 9 : kernel (RHSA-2026:10108)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:10108 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth: MGMT: Fix possible...

kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg

A flaw was found in the Linux kernel. A local unprivileged process can exploit an unsafe requeue path in the rxrpcrecvmsg function by using AFRXRPC sockets with MSGDONTWAIT and MSGPEEK flags. This improper handling of the receive message queue can lead to memory corruption, such as Use-After-Free...

kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg

A flaw was found in the Linux kernel. A local unprivileged process can exploit an unsafe requeue path in the rxrpcrecvmsg function by using AFRXRPC sockets with MSGDONTWAIT and MSGPEEK flags. This improper handling of the receive message queue can lead to memory corruption, such as Use-After-Free...

PT-2026-36326

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the rxrpc preparse function, the non-XDR path for parsing key payloads used for payloads 28 bytes or smaller fails to validate the ticket length against AFSTOKEN RK TIX MAX. This...

kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg

A flaw was found in the Linux kernel. A local unprivileged process can exploit an unsafe requeue path in the rxrpcrecvmsg function by using AFRXRPC sockets with MSGDONTWAIT and MSGPEEK flags. This improper handling of the receive message queue can lead to memory corruption, such as Use-After-Free...

kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg

A flaw was found in the Linux kernel. A local unprivileged process can exploit an unsafe requeue path in the rxrpcrecvmsg function by using AFRXRPC sockets with MSGDONTWAIT and MSGPEEK flags. This improper handling of the receive message queue can lead to memory corruption, such as Use-After-Free...

RHEL 10 : kernel (RHSA-2026:9095)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9095 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of Servi...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007412)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007412 advisory. In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix oops due to non-existence of prealloc backlog struct If an AFRXRPC service socket is...

PT-2026-34987

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory corruption issue exists in the RxRPC subsystem of the Linux kernel, specifically within the rxgk verify response function. The function incorrectly validates the auth len...

PT-2026-34986

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak exists in the rxrpc server keyring function. This issue occurs because the system fails to check if rx-securities is already set before proceeding. Recommendations...