In the Linux kernel

#!/usr/bin/env bash
# check-cve-2026-31635.sh
# Determine likely exposure to CVE-2026-31635 on a Linux host.
# Logic:
#   - CVE affects upstream kernels >= 6.16 before 6.18.23 / 6.19.13 / 7.0
#   - Vulnerable path requires CONFIG_AF_RXRPC and CONFIG_RXGK
#   - Distro backports can make version-only checks unreliable, so ambiguous cases return UNKNOWN
# Exit codes:
#   0 = PATCHED / NOT AFFECTED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

say() { printf '%s\n' "$*"; }

KREL="$(uname -r)"
KBASE="$(printf '%s' "$KREL" | sed -E 's/^([0-9]+\.[0-9]+\.[0-9]+).*/\1/')"

verlt() { [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]; }
verlte() { [ "$1" = "$2" ] || verlt "$1" "$2"; }
vergt() { [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ] && [ "$1" != "$2" ]; }
vergte() { [ "$1" = "$2" ] || vergt "$1" "$2"; }

get_cfg() {
  local key="$1"
  local src=""
  if [ -r /proc/config.gz ]; then
    src="/proc/config.gz"
    zgrep -E "^${key}=" /proc/config.gz 2>/dev/null | head -n1
    return
  fi
  if [ -r "/boot/config-$KREL" ]; then
    src="/boot/config-$KREL"
    grep -E "^${key}=" "/boot/config-$KREL" 2>/dev/null | head -n1
    return
  fi
  return 1
}

cfg_rxrpc="$(get_cfg CONFIG_AF_RXRPC || true)"
cfg_rxgk="$(get_cfg CONFIG_RXGK || true)"

have_rxrpc="unknown"
have_rxgk="unknown"

case "$cfg_rxrpc" in
  CONFIG_AF_RXRPC=y|CONFIG_AF_RXRPC=m) have_rxrpc="yes" ;;
  CONFIG_AF_RXRPC=n) have_rxrpc="no" ;;
  "") have_rxrpc="unknown" ;;
esac

case "$cfg_rxgk" in
  CONFIG_RXGK=y|CONFIG_RXGK=m) have_rxgk="yes" ;;
  CONFIG_RXGK=n) have_rxgk="no" ;;
  "") have_rxgk="unknown" ;;
esac

# Quick not-affected cases
if verlt "$KBASE" "6.16.0"; then
  say "PATCHED"
  say "Reason: upstream affected range starts at 6.16, and this host is running $KREL"
  exit 0
fi

if [ "$have_rxrpc" = "no" ] || [ "$have_rxgk" = "no" ]; then
  say "PATCHED"
  say "Reason: required kernel feature path is not enabled (AF_RXRPC=$have_rxrpc, RXGK=$have_rxgk)"
  exit 0
fi

# Upstream fixed versions
if vergte "$KBASE" "7.0.0"; then
  say "PATCHED"
  say "Reason: mainline 7.0 and later include the upstream fix"
  exit 0
fi

# 6.18.x branch fix point
if vergte "$KBASE" "6.18.23" && verlt "$KBASE" "6.19.0"; then
  say "PATCHED"
  say "Reason: 6.18.23+ includes the stable fix point"
  exit 0
fi

# 6.19.x branch fix point
if vergte "$KBASE" "6.19.13" && verlt "$KBASE" "7.0.0"; then
  say "PATCHED"
  say "Reason: 6.19.13+ includes the stable fix point"
  exit 0
fi

# Likely vulnerable upstream windows
likely_vuln="no"
if vergte "$KBASE" "6.16.0" && verlt "$KBASE" "6.18.23"; then
  likely_vuln="yes"
fi
if vergte "$KBASE" "6.19.0" && verlt "$KBASE" "6.19.13"; then
  likely_vuln="yes"
fi

# Gather practical reachability clues
listening="no"
if command -v ss >/dev/null 2>&1; then
  if ss -H -u -l -n 2>/dev/null | awk '{print $5}' | grep -Eq ':(7000|7001|7002|7003|7004|7005|7006|7007|7008|7009|7020|7021|7022|7023)$'; then
    listening="yes"
  fi
fi

loaded_rxrpc="no"
loaded_rxgk="no"
if lsmod 2>/dev/null | awk '{print $1}' | grep -qx 'rxrpc'; then loaded_rxrpc="yes"; fi
if lsmod 2>/dev/null | awk '{print $1}' | grep -qx 'rxgk'; then loaded_rxgk="yes"; fi

# Distro kernels may backport fixes without changing the base version enough.
# If the host looks like a vendor kernel with a potentially vulnerable base version, be conservative.
vendor_kernel="no"
printf '%s' "$KREL" | grep -Eq '(amzn|el[0-9]|uek|azure|aws|gcp|generic|lowlatency|kali|arch|fc[0-9]|deb[0-9]|ubuntu)' && vendor_kernel="yes"

if [ "$likely_vuln" = "yes" ]; then
  if [ "$have_rxrpc" = "yes" ] && [ "$have_rxgk" = "yes" ]; then
    if [ "$vendor_kernel" = "yes" ]; then
      say "UNKNOWN"
      say "Reason: kernel base version $KBASE is in an upstream vulnerable window and required features are enabled, but distro backports may already have fixed $KREL"
      say "Clues: RXRPC loaded=$loaded_rxrpc, RXGK loaded=$loaded_rxgk, AFS/RxRPC UDP listener seen=$listening"
      exit 2
    else
      say "VULNERABLE"
      say "Reason: upstream version $KREL falls in a published affected window and required features are enabled"
      say "Clues: RXRPC loaded=$loaded_rxrpc, RXGK loaded=$loaded_rxgk, AFS/RxRPC UDP listener seen=$listening"
      exit 1
    fi
  fi

  say "UNKNOWN"
  say "Reason: upstream version is in range, but kernel config visibility is incomplete (AF_RXRPC=$have_rxrpc, RXGK=$have_rxgk)"
  exit 2
fi

say "UNKNOWN"
say "Reason: unable to map $KREL cleanly to the published upstream windows/fix points"
exit 2