ACK: [SRU][Q][PATCH 0/1] CVE-2026-31636

[Jian Hui Lee]

Acked-by: Jian Hui Lee <jianhui.lee at canonical.com>

On Tue, Jun 23, 2026 at 11:51 AM Cengiz Can via kernel-team
<kernel-team at lists.ubuntu.com> wrote:
>
> https://ubuntu.com/security/CVE-2026-31636
>
> [ Impact ]
>
> The rxrpc RxGK security class mishandles the bounds of the RESPONSE
> authenticator parser. rxgk_verify_authenticator() copies auth_len bytes into a
> temporary buffer but passes p + auth_len as the parser limit, where p is a
> __be32 pointer, inflating the end pointer by a factor of four. This lets a
> malformed RESPONSE authenticator read past the kmalloc() buffer, resulting in a
> slab out-of-bounds read that can be triggered remotely during connection
> processing.
>
> [ Fix ]
>
> questing: clean cherry-pick
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this rxrpc/rxgk parser change could affect verification of
> RESPONSE authenticators in the yfs-rxgk security class, potentially causing
> valid AFS/kafs connections to be rejected or mis-parsed.
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team