[SRU][Q][PATCH 0/1] CVE-2026-31636

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-31636

[ Impact ]

The rxrpc RxGK security class mishandles the bounds of the RESPONSE
authenticator parser. rxgk_verify_authenticator() copies auth_len bytes into a
temporary buffer but passes p + auth_len as the parser limit, where p is a
__be32 pointer, inflating the end pointer by a factor of four. This lets a
malformed RESPONSE authenticator read past the kmalloc() buffer, resulting in a
slab out-of-bounds read that can be triggered remotely during connection
processing.

[ Fix ]

questing: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this rxrpc/rxgk parser change could affect verification of
RESPONSE authenticators in the yfs-rxgk security class, potentially causing
valid AFS/kafs connections to be rejected or mis-parsed.