{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.19.13-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: fix RESPONSE authenticator parser OOB read  rxgk_verify_authenticator() copies auth_len bytes into a temporary buffer and then passes p + auth_len as the parser limit to rxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the parser end pointer by a factor of four and lets malformed RESPONSE authenticators read past the kmalloc() buffer.  Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh:  BUG: KASAN: slab-out-of-bounds in rxgk_verify_response() Call Trace:  dump_stack_lvl() [lib/dump_stack.c:123]  print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482]  kasan_report() [mm/kasan/report.c:597]  rxgk_verify_response()    [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167     net/rxrpc/rxgk.c:1274]  rxrpc_process_connection()    [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364     net/rxrpc/conn_event.c:386]  process_one_work() [kernel/workqueue.c:3281]  worker_thread()    [kernel/workqueue.c:3353 kernel/workqueue.c:3440]  kthread() [kernel/kthread.c:436]  ret_from_fork() [arch/x86/kernel/process.c:164]  Allocated by task 54:  rxgk_verify_response()    [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155     net/rxrpc/rxgk.c:1274]  rxrpc_process_connection()    [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364     net/rxrpc/conn_event.c:386]  Convert the byte count to __be32 units before constructing the parser limit.",
  "id": "DEBIAN-CVE-2026-31636",
  "modified": "2026-09-14T16:47:49.154254241Z",
  "published": "2026-04-24T15:16:42.920Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-31636"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-31636"
  ]
}