Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-31630

rxrpc: proc: size address buffers for %pISpc output

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.258, 5.15.209, 6.1.175, 6.6.160, 6.12.114, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc". That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf(). Changes since v1: • correct the changelog to cite the actual maximum current-tree case explicitly • frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 75b54cb57ca34cbe7a87c6ac757c55360a624590 · fixed in 386c86412608d3449006a318a662cbcd6ca1f668; From 75b54cb57ca34cbe7a87c6ac757c55360a624590 · fixed in 235b2115de892eab2e107a42efa7a4347baaa80b; From 75b54cb57ca34cbe7a87c6ac757c55360a624590 · fixed in 625af53a1564e31bb2df9adc3739df46137f46c1; From 75b54cb57ca34cbe7a87c6ac757c55360a624590 · fixed in 808a34cdbe8ce336c202d8ea6d5e48496764dc37; From 75b54cb57ca34cbe7a87c6ac757c55360a624590 · fixed in a6042b8066b24dbcc7945616a157d4d43e463668; From 75b54cb57ca34cbe7a87c6ac757c55360a624590 · fixed in db297c78ce537c9ac96f0eda9b25ad72c8caefa9; From 75b54cb57ca34cbe7a87c6ac757c55360a624590 · fixed in 10ebed83f9f6414af4e85bc85ffaeda7effdd874; From 75b54cb57ca34cbe7a87c6ac757c55360a624590 · fixed in a44ce6aa2efb61fe44f2cfab72bb01544bbca272

  • Linux Linux

    4.9

  • KernelLinux

    From 4.9.0 · fixed in 5.10.258; From 5.11.0 · fixed in 5.15.209; From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.23; From 6.19.0 · fixed in 6.19.13

References 8

git.kernel.org