Skip to main content

Linux Kernel CVE-2026-31639

| EUVDEUVD-2026-25532 MEDIUM
2026-04-24 Linux GHSA-4xm4-6p23-gp97
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

AV:L and PR:L because exploitation requires a local authenticated session; C:N and I:N confirmed by description; A:H because sustained leaking exhausts system-wide keyring quotas.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:51 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:20 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25532
CVE Published
Apr 24, 2026 - 14:44 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix key reference count leak from call->key

When creating a client call in rxrpc_alloc_client_call(), the code obtains a reference to the key. This is never cleaned up and gets leaked when the call is destroyed.

Fix this by freeing call->key in rxrpc_destroy_call().

Before the patch, it shows the key reference counter elevated:

$ cat /proc/keys | grep afs@54321 1bffe9cd I--Q--i 8053480 4169w 3b010000 1000 1000 rxrpc afs@54321: ka $

After the patch, the invalidated key is removed when the code exits:

$ cat /proc/keys | grep afs@54321 $

AnalysisAI

Reference count leak in the rxrpc subsystem of the Linux kernel allows a local low-privilege user to exhaust kernel keyring resources, causing denial of service. The flaw exists in rxrpc_alloc_client_call(), which acquires a reference to call->key but never releases it in rxrpc_destroy_call(), causing the key reference counter to increment indefinitely across repeated client call creation and destruction. EPSS at 0.02% (5th percentile) and no KEV listing confirm this carries negligible real-world exploitation urgency; no public exploit is identified at time of analysis.

Technical ContextAI

The rxrpc kernel subsystem implements the RxRPC reliable datagram protocol over UDP, used primarily by the AFS (Andrew File System) distributed filesystem client. The Linux kernel's keyring subsystem tracks authentication credentials via reference-counted key objects. In rxrpc_alloc_client_call(), a reference is taken on call->key to bind authentication material to the lifecycle of a client call. Due to the omission of a corresponding key_put() (or equivalent release) in rxrpc_destroy_call(), each destroyed client call leaves the key object's reference counter permanently elevated. Although CWE is listed as N/A, this maps to CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-401 (Missing Release of Memory after Effective Lifetime). The bug was introduced at kernel commit f3441d4125fc98995858550a5521b8d7daf0504a and affects all stable branches from that point forward until the respective backport fixes. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary remediation is to upgrade to a patched Linux kernel version: 6.12.82, 6.6.135, 6.18.23, 6.19.13, or 7.0+. Upstream fix commits are available at git.kernel.org/stable: f1a7a3ab0f35f83cf11bba906b9e948cf3788c28, e6b7943c5dc875647499da09bf4d50a8557ab0c3, 2e6ef713b1598f6acd7f302fa6b12b6731c89914, 978108902ee4ef2b348ff7ec36ad014dc5bc6dc6, and d666540d217e8d420544ebdfbadeedd623562733. Ubuntu users should follow USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1) for distribution-packaged kernel updates. For systems that do not use AFS or rxrpc, a compensating control is to blacklist the rxrpc kernel module by adding 'blacklist rxrpc' to /etc/modprobe.d/disable-rxrpc.conf and rebooting; this eliminates the attack surface entirely but will break any AFS client functionality on the system. No other workarounds that preserve rxrpc functionality are available prior to patching.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31639 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy