CVE-2026-31635

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: fix oversized RESPONSE authenticator length check

rxgkverifyresponse() decodes authlen from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are accepted and passed to rxgkdecryptskb(), which can later reach skbtosgvec() with an impossible length and hit BUGON(len).

Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh:

RIP: _skbtosgvec() [net/core/skbuff.c:5285 (discriminator 1)] Call Trace: skbtosgvec() [net/core/skbuff.c:5305] rxgkdecryptskb() [net/rxrpc/rxgkcommon.h:81] rxgkverifyresponse() [net/rxrpc/rxgk.c:1268] rxrpcprocessconnection() [net/rxrpc/connevent.c:266 net/rxrpc/connevent.c:364 net/rxrpc/connevent.c:386] processonework() [kernel/workqueue.c:3281] workerthread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] retfromfork() [arch/x86/kernel/process.c:164]

Reject authenticator lengths that exceed the remaining packet payload.