On April 24, 2026, the U.S. National Vulnerability Database published CVE-2026-31630, a flaw in the Linux kernel that stems from a one-byte mistake—a buffer made just a byte too small to hold the full text of an IPv6 address with a port number. The bug, nestled in the kernel’s AF_RXRPC subsystem, can be triggered by reading certain /proc files, and while it may sound trivial, it could crash your system or enable privilege escalation. No CVSS score has been assigned yet, leaving administrators to judge the risk based on technical details.

One Byte Short of Disaster

The vulnerable code sits in net/rxrpc/proc.c, where the Linux kernel formats socket addresses for display in the /proc filesystem. Procfs is the standard way administrators and monitoring tools peek into kernel internals—everything from process lists to network connections. The AF_RXRPC helpers used a fixed 50-byte stack buffer to build human-readable strings with the %pISpc format specifier, which prints an IP socket address and port.

That 50-byte constant assumed no address would ever need more than 49 visible characters plus a NUL terminator. It turns out that assumption breaks for a specific IPv6 address pattern. When an ISATAP-style dotted-quad tail is combined with a port number, the formatter produces exactly 50 visible characters, as in [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535. The C string’s trailing NUL pushes the total to 51 bytes, overflowing the 50-byte buffer by one byte.

The fix, already accepted into the mainline Linux kernel, replaces the hard-coded buffer size with the formatter’s own maximum string length constant. It also switches from sprintf() to scnprintf(), which respects the destination buffer size. While the change is just a few lines, it closes a memory-safety gap that sat in a diagnostic code path most users never think about.

Who’s Affected? From WSL to Data Centers

Windows users might be tempted to ignore a Linux kernel CVE, but that would be a mistake. WSL 2 runs a real Linux kernel inside a lightweight VM—Microsoft ships and services that kernel independently of the Windows host. So if you use WSL for development, container testing, or server workloads, you have a Linux kernel to patch.

Most WSL instances never load the AF_RXRPC module, because RxRPC is a specialized protocol linked to the Andrew File System (AFS). But the module can exist in the kernel tree, and the bug is reachable by simply reading related /proc entries. For a typical developer running Ubuntu on WSL to write code, the immediate risk is low—but only if the kernel stays updated.

Enterprise teams face a broader exposure. Linux virtual machines on Hyper-V, cloud instances in Azure, container hosts, and security appliances all run vendor kernels. The danger rises on multi-user systems where local users can read /proc/net/rxrpc/* files. In a real attack scenario, an intruder who already has a foothold could leverage this off-by-one to crash the system or potentially corrupt memory for privilege escalation.

The good news: there is no evidence of remote exploitation or public exploit code. The trigger requires local access to a procfs file, and the overflow is small. However, researchers have repeatedly shown that one-byte overflows can be weaponized when combined with other weaknesses. Administrators should treat this as a moderate but real priority, especially on systems that actually use AFS or RxRPC.

How an IPv6 Address Broke the Kernel

The root cause is a classic C programming mistake: trusting a visual string length instead of the format specifier’s documented maximum. The %pISpc formatter handles many IPv6 text representations, and the longest one involves ISATAP, a transition mechanism that embeds an IPv4 address in the IPv6 suffix. The resulting string is longer than the fully expanded colon-hex form that developers might intuitively expect.

This edge case was identified during review after the initial patch relied on a mapped-IPv4 example. Kernel developers sharpened the proof to the current-tree ISATAP path, turning a plausible concern into a concrete, reproducible maximum. It’s a textbook example of why security fixes need precise reproduction rather than hand-waving.

The bug also illustrates why the Linux kernel project now assigns CVEs to tiny memory-safety fixes that older processes might have ignored. More CVEs means more noise, but also fewer invisible vulnerabilities. For defenders, the challenge is separating the signal from the volume—a task made harder when NVD enrichment lags, as it still does for CVE-2026-31630.

Your Patch and Mitigation Checklist

Until a CVSS score arrives, action depends on your own risk assessment. Here’s a practical checklist that covers Windows/Linux hybrid estates:

  1. Inventory your kernels. Run uname -r on every Linux box, including WSL instances (wsl --status shows the kernel version).
  2. Check for RxRPC exposure. Use lsmod | grep rxrpc to see if the module is loaded. Look for AFS-related packages with dpkg -l | grep afs or rpm -qa | grep afs.
  3. Follow vendor advisories. SUSE has already marked the issue under analysis; Red Hat, Canonical, and others should follow. For WSL, monitor the official WSL kernel release notes.
  4. Apply the update and reboot. Installing a kernel package doesn’t protect you until you restart. On WSL, run wsl --update and then terminate all WSL instances with wsl --shutdown before restart.
  5. Double-check procfs visibility. On multi-user systems, ensure that /proc/net/rxrpc is not world-readable unless absolutely necessary (check with ls -la).
  6. Validate scanner results. Some scanners may flag older kernels that already have the fix backported. Cross-reference with your distribution’s security page.
  7. Document exceptions. If a vendor hasn’t released a patch yet, record the risk acceptance and apply other mitigations like restricting local access.

For Windows hosts running Hyper-V or Azure Stack HCI, the guest VMs must be patched independently of the host. Microsoft’s Azure Marketplace images will receive the fix as part of their normal pipeline, but custom images need manual attention. Container hosts require kernel-level patching regardless of container image updates.

The Lasting Lesson: Buffer Math Matters

CVE-2026-31630 won’t be the biggest kernel vulnerability of the year, but it exposes a systemic weakness: even diagnostic code in the kernel can become a security liability. The old mantra that “procfs is just for debugging” doesn’t hold when every local user can read those files.

As NVD enrichment completes and distributors push out their patches, the next few weeks will show how quickly the ecosystem responds. Early signals from SUSE and stable-kernel mailing lists suggest the fix is straightforward and unlikely to cause regressions. Microsoft’s WSL team has historically been prompt with security updates, though the timing varies.

For teams that manage mixed Windows and Linux environments, this CVE is a forcing function. It’s a chance to test your kernel update pipeline, scanner accuracy, and the not-always-obvious boundary between Windows host patching and Linux guest maintenance. If your response to a minor off-by-one is well-rehearsed, you’ll be ready when a truly severe kernel bug arrives.