High 7.8Published Apr 24, 2026

CVE-2026-31630rxrpc: proc: size address buffers for %pISpc output

Updated under an hour ago (Oct 27, 2026, 11:10 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc". That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-121
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 75b54cb57ca34cbe7a87c6ac757c55360a624590 before 386c86412608d3449006a318a662cbcd6ca1f668; from 75b54cb57ca34cbe7a87c6ac757c55360a624590 before 235b2115de892eab2e107a42efa7a4347baaa80b; from 75b54cb57ca34cbe7a87c6ac757c55360a624590 before 625af53a1564e31bb2df9adc3739df46137f46c1; from 75b54cb57ca34cbe7a87c6ac757c55360a624590 before 808a34cdbe8ce336c202d8ea6d5e48496764dc37; from 75b54cb57ca34cbe7a87c6ac757c55360a624590 before a6042b8066b24dbcc7945616a157d4d43e463668; from 75b54cb57ca34cbe7a87c6ac757c55360a624590 before db297c78ce537c9ac96f0eda9b25ad72c8caefa9; 75b54cb57ca34cbe7a87c6ac757c55360a624590 builds before 10ebed83f9f6414af4e85bc85ffaeda7effdd874; from 75b54cb57ca34cbe7a87c6ac757c55360a624590 before a44ce6aa2efb61fe44f2cfab72bb01544bbca272	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.9.1 before 6.18.23; from 6.19 before 6.19.13; 4.9; 7.0; 7.0; 7.0; 7.0; 7.0; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/386c86412608d3449006a318a662cbcd6ca1f668
https://git.kernel.org/stable/c/235b2115de892eab2e107a42efa7a4347baaa80b
https://git.kernel.org/stable/c/625af53a1564e31bb2df9adc3739df46137f46c1
https://git.kernel.org/stable/c/808a34cdbe8ce336c202d8ea6d5e48496764dc37
https://git.kernel.org/stable/c/a6042b8066b24dbcc7945616a157d4d43e463668
https://git.kernel.org/stable/c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9	patch
https://git.kernel.org/stable/c/10ebed83f9f6414af4e85bc85ffaeda7effdd874	patch
https://git.kernel.org/stable/c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.