Linux Kernel CVE-2026-31632

The vulnerability resides in the rxrpc (Reliable Datagram Sockets over RPC) subsystem, specifically the rxgk module implementing RxGK - a GSS-API-based security mechanism for AFS (Andrew File System) transport authentication. CWE-401 (Missing Release of Memory After Effective Lifetime) identifies the root cause: rxgk_verify_response() allocates an rxgk security context to process inbound authentication responses but fails to free this allocation before returning on at least one code path, producing a kernel memory leak. The CPE data (cpe:2.3:a:linux:linux:*) confirms the flaw spans kernel builds from the introducing commit 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a onward. Because RxGK is only active when the kafs (kAFS) kernel module is loaded and AFS is configured with RxGK authentication, the vulnerable code is unreachable on the overwhelming majority of Linux hosts. The 'Information Disclosure' tag present in the intelligence feed conflicts with both the CVSS C:N metric and the CWE-401 classification - it appears to be a feed-level misclassification and should be disregarded in favor of the authoritative CVSS vector and kernel commit description.