CVE-2026-31635 RxRPC: Linux Kernel Remote Procedure Call (RxRPC) protocol Vulnerability.

Impacted Products

• CubeCOS

Introduction

This advisory covers CVE-2026-31635 (DirtyDecrypt / DirtyCBC).

A vulnerability has been identified in the Linux Kernel’s Remote Procedure Call (RxRPC) protocol implementation (CONFIG_RXGK), which is present as a loadable module in current versions of kernels supporting CubeCOS 3.1.0 or older (specifically targeting kernel versions such as 6.12.74-1.el9.x86_64). This vulnerability involves an inverted length check within the rxgk_verify_response() function. While the underlying kernel package contains the vulnerable module, CubeCOS employs a modular architecture where this driver is not loaded by default, significantly reducing the immediate, out-of-the-box exploitability of this flaw in production environments.

Description

The vulnerability resides in how the rxrpc subsystem handles oversized RESPONSE authenticators, potentially resulting in memory corruption and a direct path to local root execution.
Unlike built-in monolithic kernel features, audit data shows that CubeCOS compiles this feature as a dynamic loadable kernel module (rxrpc.ko.xz located within /lib/modules/6.12.74-1.el9.x86_64/kernel/net/rxrpc).

Runtime verification indicates that the module is inactive by default:

• cat /proc/kallsyms | grep rxgk_verify_response returns no active memory addresses.
• lsmod | grep -E "rxgk|rxrpc" confirms the module is not currently resident in memory.

Because this code exists purely as a dormant file on disk, the system cannot be exploited unless an application, user, or network process forces the kernel to dynamically load the module.

Risk Assessment & Exposure

The immediate risk to CubeCOS users is heavily mitigated by the following architectural and environmental constraints:

• Passive State: The vulnerable module is compiled but completely un-run at boot, eliminating the default runtime attack surface.
• Restricted Access Control: CubeCOS does not permit general user access. System access is strictly limited to:
• Root Account: Reserved exclusively for authorized support engineers.
• Admin (CLI) Account: Restricted to a Command Line Interface (CLI) providing a menu of pre-tested, limited-scope operations.
• Network Isolation: Access to management interfaces (SSH) is only possible via physical presence or a dedicated management network protected by a VPN, hindering initial vector access.

Mitigation Strategies

Short-Term Mitigations (Immediate Action)

Because the component is a loadable module, administrators can entirely eliminate the threat surface by preventing the kernel from ever initializing it. Apply the following steps to immunize the runtime environment:

1. Enforce Module Blacklisting: Create a configuration file within the host's modprobe directory to explicitly block the driver and force any dynamic loading attempts to safely fail. 
   echo "blacklist rxrpc" | sudo tee /etc/modprobe.d/cve-2026-31635-mitigation.confecho "install rxrpc /bin/true" | sudo tee -a /etc/modprobe.d/cve-2026-31635-mitigation.conf
2. Disable Containerized Scripting Features: Ensure that container-based custom alert response scripting remains disabled to prevent unvetted workloads from attempting to probe network sockets that could auto-load kernel modules.
3. Log Monitoring: Audit system behavior for unexpected modprobe events or local security boundary changes.

Long-Term Mitigation (Permanent Fix)

The vulnerability is permanently addressed through an upstream kernel update that replaces the flawed length-validation logic.

• Resolution: Upgrade to the patched CubeCOS version.
• Fix: Future releases will supply a patched kernel package resolving the underlying memory corruption vector.

Virtual Machine (Guest OS) Recommendations

While the CubeCOS host platform maintains structural isolation, the security of individual Virtual Machines (VMs) running on top of the hypervisor layer remains a shared responsibility.

• Tenant Vulnerability Scanning: Tenants are strongly encouraged to independently inspect their unique VM workloads. If a Guest OS runs an unpatched kernel utilizing rxrpc/rxgk network filesystems, it may be independently susceptible to local privilege escalation from inside the VM container.
• Guest Patching: Ensure that all Linux-based guest appliances are regularly updated to their respective upstream distribution's latest stable micro-patch.

Deployment Schedule

A patch is currently under development. Customers will be formally notified via the standard release distribution channel once the update is available for download and rolling installation.

Note: For systems where immediate reboots are restricted by production uptime demands, applying the modprobe short-term mitigation provides a complete and robust defense-in-depth posture that nullifies the exploitation vector.

References

List

• https://nvd.nist.gov/vuln/detail/CVE-2026-31635
• https://access.redhat.com/security/cve/cve-2026-31635

Change Log

Contact Us