{"id":"CVE-2026-31630","revision":"80650c7a003744dc892404bfcafa675a","records":[{"revision":"80650c7a003744dc892404bfcafa675a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-31630","aliases":[],"title":"rxrpc: proc: size address buffers for %pISpc output","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: proc: size address buffers for %pISpc output\n\nThe AF_RXRPC procfs helpers format local and remote socket addresses into\nfixed 50-byte stack buffers with \"%pISpc\".\n\nThat is too small for the longest current-tree IPv6-with-port form the\nformatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a\ndotted-quad tail not only for v4mapped addresses, but also for ISATAP\naddresses via ipv6_addr_is_isatap().\n\nAs a result, a case such as\n\n [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nis possible with the current formatter. That is 50 visible characters, so\n51 bytes including the trailing NUL, which does not fit in the existing\nchar[50] buffers used by net/rxrpc/proc.c.\n\nSize the buffers from the formatter's maximum textual form and switch the\ncall sites to scnprintf().\n\nChanges since v1:\n- correct the changelog to cite the actual maximum current-tree case\n explicitly\n- frame the proof around the ISATAP formatting path instead of the earlier\n mapped-v4 example","state":0,"publishedAt":"2026-04-24T14:44:46.606+00:00","modifiedAt":"2026-10-21T12:39:36.441+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/rxrpc/proc.c\"\n ],\n \"versions\": [\n {\n \"version\": \"75b54cb57ca34cbe7a87c6ac757c55360a624590\",\n \"lessThan\": \"386c86412608d3449006a318a662cbcd6ca1f668\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"75b54cb57ca34cbe7a87c6ac757c55360a624590\",\n \"lessThan\": \"235b2115de892eab2e107a42efa7a4347baaa80b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"75b54cb57ca34cbe7a87c6ac757c55360a624590\",\n \"lessThan\": \"625af53a1564e31bb2df9adc3739df46137f46c1\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"75b54cb57ca34cbe7a87c6ac757c55360a624590\",\n \"lessThan\": \"808a34cdbe8ce336c202d8ea6d5e48496764dc37\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"75b54cb57ca34cbe7a87c6ac757c55360a624590\",\n \"lessThan\": \"a6042b8066b24dbcc7945616a157d4d43e463668\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"75b54cb57ca34cbe7a87c6ac757c55360a624590\",\n \"lessThan\": \"db297c78ce537c9ac96f0eda9b25ad72c8caefa9\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"75b54cb57ca34cbe7a87c6ac757c55360a624590\",\n \"lessThan\": \"10ebed83f9f6414af4e85bc85ffaeda7effdd874\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"75b54cb57ca34cbe7a87c6ac757c55360a624590\",\n \"lessThan\": \"a44ce6aa2efb61fe44f2cfab72bb01544bbca272\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/rxrpc/proc.c\"\n ],\n \"versions\": [\n {\n \"version\": \"4.9\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"4.9\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.258\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.209\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.175\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.160\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.114\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.23\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.19.13\",\n \"lessThanOrEqual\": \"6.19.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.0\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/386c86412608d3449006a318a662cbcd6ca1f668","https://git.kernel.org/stable/c/235b2115de892eab2e107a42efa7a4347baaa80b","https://git.kernel.org/stable/c/625af53a1564e31bb2df9adc3739df46137f46c1","https://git.kernel.org/stable/c/808a34cdbe8ce336c202d8ea6d5e48496764dc37","https://git.kernel.org/stable/c/a6042b8066b24dbcc7945616a157d4d43e463668","https://git.kernel.org/stable/c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9","https://git.kernel.org/stable/c/10ebed83f9f6414af4e85bc85ffaeda7effdd874","https://git.kernel.org/stable/c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31630","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-31630","identifiers":["CVE-2026-31630"]},"retained":false,"historicalAffected":[]}],"coverage":[]}