# CVE-2026-31630: rxrpc: proc: size address buffers for %pISpc output

CVE-2026-31630 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-31630, released May 15, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-31630
- Priority: High
- CVSS: 7.8 (Important)
- EPSS: 0.0018
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 24, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31630

## Description

In the Linux kernel, the following vulnerability has been resolved:  rxrpc: proc: size address buffers for %pISpc output  The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc".  That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap().  As a result, a case such as    [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535  is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c.  Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf().  Changes since v1: - correct the changelog to cite the actual maximum current-tree case   explicitly - frame the proof around the ISATAP formatting path instead of the earlier   mapped-v4 example

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.176-1 | [DEBIAN-CVE-2026-31630](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31630.md) | May 15, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-31630](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31630.md) | May 15, 2026 |
| Linux | linux Debian 14 | 6.19.13-1 | [DEBIAN-CVE-2026-31630](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31630.md) | May 15, 2026 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.