Skip to main content

Linux Kernel CVE-2026-31638

| EUVDEUVD-2026-25531 HIGH
NULL Pointer Dereference (CWE-476)
2026-04-24 Linux GHSA-5vqj-w88j-2624
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

8
Re-analysis Queued
Apr 27, 2026 - 20:22 vuln.today
cvss_changed
Patch released
Apr 27, 2026 - 20:20 nvd
Patch available
Analysis Generated
Apr 27, 2026 - 15:39 vuln.today
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25531
Analysis Generated
Apr 24, 2026 - 15:00 vuln.today
CVE Published
Apr 24, 2026 - 14:44 nvd
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Only put the call ref if one was acquired

rxrpc_input_packet_on_conn() can process a to-client packet after the current client call on the channel has already been torn down. In that case chan->call is NULL, rxrpc_try_get_call() returns NULL and there is no reference to drop.

The client-side implicit-end error path does not account for that and unconditionally calls rxrpc_put_call(). This turns a protocol error path into a kernel crash instead of rejecting the packet.

Only drop the call reference if one was actually acquired. Keep the existing protocol error handling unchanged.

AnalysisAI

Null pointer dereference in Linux kernel rxrpc subsystem allows remote network attackers to crash the system by sending malformed packets to a client-side connection after a call has been torn down. The flaw affects Linux kernel versions 6.2 onward where the rxrpc client code unconditionally releases a call reference that was never acquired, converting a protocol error into a kernel panic. Vendor patches are available across stable branches (6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0). EPSS exploitation probability is low (0.02%, 5th percentile) and no public exploit has been identified at time of analysis.

Technical ContextAI

The rxrpc subsystem implements the RxRPC protocol used by AFS (Andrew File System) in the Linux kernel. This vulnerability exists in the client-side packet processing path where rxrpc_input_packet_on_conn() handles incoming packets on an established connection channel. The flaw occurs in a race condition scenario: when a to-client packet arrives after the current client call (chan->call) has already been destroyed, rxrpc_try_get_call() correctly returns NULL since no call exists. However, the implicit-end error path incorrectly assumes a reference was always obtained and unconditionally calls rxrpc_put_call() on the NULL pointer. This reference counting logic error (similar to CWE-476 NULL pointer dereference patterns) turns what should be a graceful protocol error rejection into a kernel crash. The vulnerability was introduced in commit 5e6ef4f1017c7 and affects kernel 6.2 onward based on the EUVD commit range data.

RemediationAI

Upgrade to patched Linux kernel versions: 6.6.135, 6.12.82, 6.18.23, 6.19.13, or 7.0 and later. Patch commits add a conditional check ensuring rxrpc_put_call() is only invoked when rxrpc_try_get_call() successfully acquired a reference (commits 6331f1b24a3e, b8f66447448d, 0c156aff8a2d, 8299ca146489, 9fb09861e2b8 across stable branches). For systems that cannot immediately upgrade, a compensating control is to disable rxrpc client functionality if not required for AFS operations by preventing the rxrpc kernel module from loading (add 'install rxrpc /bin/true' to /etc/modprobe.d/blacklist.conf and rebuild initramfs). Note this mitigation breaks AFS client functionality and should only be used on systems not relying on the rxrpc protocol. No workaround exists for systems that must maintain rxrpc client capabilities - immediate patching is required. Detailed patch information is available at kernel.org stable tree URLs listed in CVE references.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31638 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy