PT-2026-34989 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-04-28 · CVE-2026-31637

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The rxkad decrypt ticket() function decrypts the RXKAD response ticket but parses the buffer as plaintext without verifying if the crypto skcipher decrypt() operation was successful. A malformed RESPONSE using a non-block-aligned ticket length can cause the decryption to fail, allowing attacker-controlled bytes to be processed by the ticket parser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31637

ECHO-E3F8-C6C9-2BC3

Affected Products

Linux Kernel

References · 16

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31637 · Vendor Advisory
• https://git.kernel.org/stable/c/58fcd1b156152613ba00a064a129fb69507ddd7d · Patch
• https://cve.org/CVERecord?id=CVE-2026-31637 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-31637 · Vendor Advisory
• https://git.kernel.org/stable/c/fe4447cd95623b1cfacc15f280aab73a6d7340b2 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31637 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-31637 · Vendor Advisory
• https://git.kernel.org/stable/c/22f6258e7b31dba9bf88dce4e3ee7f0f20072e60 · Patch
• https://ubuntu.com/security/CVE-2026-31637 · Vendor Advisory
• https://git.kernel.org/stable/c/47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8a · Patch
• https://git.kernel.org/stable/c/a149dcae23309df9de1c3b6b5d468610ef5ab7de · Patch
• https://git.kernel.org/linus/fe4447cd95623b1cfacc15f280aab73a6d7340b2 · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-31637 · Note
• https://twitter.com/VulmonFeeds/status/2047790221090042196 · Twitter Post