Skip to main content

Linux Kernel CVE-2026-31634

| EUVDEUVD-2026-25527 MEDIUM
2026-04-24 Linux GHSA-q2xh-vwfq-mwpc
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local low-privilege access required to reach rxrpc code path; no confidentiality or integrity impact, only cumulative availability degradation from the reference leak.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:51 vuln.today
CVSS changed
Apr 27, 2026 - 20:37 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:30 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25527
CVE Published
Apr 24, 2026 - 14:44 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: fix reference count leak in rxrpc_server_keyring()

This patch fixes a reference count leak in rxrpc_server_keyring() by checking if rx->securities is already set.

AnalysisAI

Reference count leak in the Linux kernel's rxrpc subsystem (rxrpc_server_keyring()) causes progressive kernel resource exhaustion when rx->securities is already initialized and the extra reference is not decremented. Affected kernels span from version 2.6.22 through multiple stable branches, with fixes backported to 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0. No public exploit identified at time of analysis, and EPSS sits at 0.02% (7th percentile), reflecting niche real-world exploitation probability despite the kernel's ubiquitous deployment footprint.

Technical ContextAI

The rxrpc subsystem implements the RxRPC protocol, primarily used by the AFS (Andrew File System) client in the Linux kernel. The vulnerable function rxrpc_server_keyring() fails to check whether rx->securities is already populated before assigning a new keyring reference, causing the previous reference to be dropped without being properly decremented. This is a classic missing-release-of-resource pattern (analogous to CWE-772) that leads to kernel object accumulation over repeated invocations. The CPE identifier cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* confirms this as a Linux kernel issue, with the vulnerable code path introduced at commit 17926a79320afa9b95df6b977b40cca6d8713cea and present since kernel 2.6.22. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects the local, low-privilege nature with purely availability impact.

RemediationAI

Upgrade to a patched kernel stable release: 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, or 7.0. Individual fix commits are available at git.kernel.org/stable/c/ for each stable branch (fc76d0bd, c6d9ea26, 9ce36d28, 12de9e0e, 8ee931c3, 139c750b, f125846e, 45d9584e). Ubuntu users should apply USN-8567-1. Siemens product operators should apply guidance from SSA-019113 and SSA-082556. As a compensating control where immediate patching is not feasible, ensure the rxrpc/AFS kernel module is not loaded on hosts that do not require AFS connectivity (rmmod rxrpc or blacklisting the module via /etc/modprobe.d/); this eliminates the vulnerable code path entirely with no functional side effect on non-AFS systems. Restricting local user access on AFS-connected hosts also limits exploitation surface.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31634 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy