In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing In rxrpc_preparse(), there are two paths for parsing key payloads: the XDR path (for large payloads) and the non-XDR path (for payloads <= 28 bytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly validates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR path fails to do so. This allows an unprivileged user to provide a very large ticket length. When this key is later read via rxrpc_read(), the total token size (toksize) calculation results in a value that exceeds AFSTOKEN_LENGTH_MAX, triggering a WARN_ON(). [ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc] Fix this by adding a check in the non-XDR parsing path of rxrpc_preparse() to ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX, bringing it into parity with the XDR parsing logic.

The version of kernel-generic installed on the remote host is prior to 5.15.209 / 5.15.209_smp / 6.12.92 / 6.18.34. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-152-01 advisory.

    New kernel packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the kernel-generic security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing In rxrpc_preparse(), there are     two paths for parsing key payloads: the XDR path (for large payloads) and the non-XDR path (for payloads     <= 28 bytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly validates the ticket length     against AFSTOKEN_RK_TIX_MAX, the non-XDR path fails to do so. This allows an unprivileged user to provide     a very large ticket length. When this key is later read via rxrpc_read(), the total token size (toksize)     calculation results in a value that exceeds AFSTOKEN_LENGTH_MAX, triggering a WARN_ON(). [ 2001.302904]     WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc] Fix this by adding a check     in the non-XDR parsing path of rxrpc_preparse() to ensure the ticket length does not exceed     AFSTOKEN_RK_TIX_MAX, bringing it into parity with the XDR parsing logic. (CVE-2026-31696)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
319301	Slackware Linux 15.0 / current kernel-generic Multiple Vulnerabilities (SSA:2026-152-01)	Nessus	Slackware Local Security Checks	high
318769	Photon OS 4.0: Linux PHSA-2026-4.0-1028	Nessus	PhotonOS Local Security Checks	high
311562	Linux Distros Unpatched Vulnerability : CVE-2026-31696	Nessus	Misc.	high

Detections

Analytics

CVE-2026-31696

high

Tenable Plugins

high

high

high