ACK: [SRU][Q][PATCH 0/1] CVE-2026-31636

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/23/26 11:51, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-31636
>
> [ Impact ]
>
> The rxrpc RxGK security class mishandles the bounds of the RESPONSE
> authenticator parser. rxgk_verify_authenticator() copies auth_len bytes into a
> temporary buffer but passes p + auth_len as the parser limit, where p is a
> __be32 pointer, inflating the end pointer by a factor of four. This lets a
> malformed RESPONSE authenticator read past the kmalloc() buffer, resulting in a
> slab out-of-bounds read that can be triggered remotely during connection
> processing.
>
> [ Fix ]
>
> questing: clean cherry-pick
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this rxrpc/rxgk parser change could affect verification of
> RESPONSE authenticators in the yfs-rxgk security class, potentially causing
> valid AFS/kafs connections to be rejected or mis-parsed.
>