Answer in brief
CVE-2026-31630 records a High severity (CVSS 7.8) vulnerability in rxrpc: proc: size address buffers for %pISpc output. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | 4.9 | Not reported |
| Linux/Linuxgeneric | >=75b54cb57ca34cbe7a87c6ac757c55360a624590 <386c86412608d3449006a318a662cbcd6ca1f668 || >=75b54cb57ca34cbe7a87c6ac757c55360a624590 <235b2115de892eab2e107a42efa7a4347baaa80b || >=75b54cb57ca34cbe7a87c6ac757c55360a624590 <625af53a1564e31bb2df9adc3739df46137f46c1 || >=75b54cb57ca34cbe7a87c6ac757c55360a624590 <db297c78ce537c9ac96f0eda9b25ad72c8caefa9 || >=75b54cb57ca34cbe7a87c6ac757c55360a624590 <10ebed83f9f6414af4e85bc85ffaeda7effdd874 || >=75b54cb57ca34cbe7a87c6ac757c55360a624590 <a44ce6aa2efb61fe44f2cfab72bb01544bbca272 | 386c86412608d3449006a318a662cbcd6ca1f668, 235b2115de892eab2e107a42efa7a4347baaa80b, 625af53a1564e31bb2df9adc3739df46137f46c1, db297c78ce537c9ac96f0eda9b25ad72c8caefa9, 10ebed83f9f6414af4e85bc85ffaeda7effdd874, a44ce6aa2efb61fe44f2cfab72bb01544bbca272 |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
Published upstream
Apr 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc". That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example
Quoted source text, attributed separately from HOL analysis.