Skip to main content

Linux Kernel CVE-2026-31643

| EUVDEUVD-2026-25536 MEDIUM
Memory Leak (CWE-401)
2026-04-24 Linux GHSA-cmpj-rg49-j7hv
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required to reach rxrpc key parsing; memory leak yields availability impact only, with no confidentiality or integrity effect confirmed.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:50 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:19 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25536
CVE Published
Apr 24, 2026 - 14:44 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix key parsing memleak

In rxrpc_preparse_xdr_yfs_rxgk(), the memory attached to token->rxgk can be leaked in a few error paths after it's allocated.

Fix this by freeing it in the "reject_token:" case.

AnalysisAI

Memory exhaustion in the Linux kernel's rxrpc subsystem allows a local low-privileged user to degrade system availability by repeatedly triggering a key parsing error path that leaks kernel memory. The flaw exists in rxrpc_preparse_xdr_yfs_rxgk(), where allocations for token->rxgk are not freed on certain error branches before jumping to reject_token. With EPSS at 0.02% (5th percentile) and no CISA KEV listing, real-world exploitation is assessed as low-probability and operationally constrained to systems actively using AFS/YFS rxrpc authentication.

Technical ContextAI

The vulnerable function rxrpc_preparse_xdr_yfs_rxgk() resides in the Linux kernel's RxRPC protocol implementation, specifically the YFS (Andrew File System variant) path for rxgk (GSS-API-based) authentication token parsing. CWE-401 (Missing Release of Memory after Effective Lifetime) is the root cause: when XDR-encoded key token processing encounters certain error conditions, the function exits via the reject_token label without freeing the heap allocation previously made for token->rxgk. The fix, applied across three stable-tree backport commits, adds the missing kfree() call in that error path. This code path is reached via the kernel keyring subsystem when rxrpc/AFS authentication keys are loaded, requiring kernel-level rxrpc module activity. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Apply the vendor-released stable kernel updates: Linux 6.18.23, 6.19.13, or 7.0 as appropriate for your branch. The three upstream fix commits are available at https://git.kernel.org/stable/c/d5f76f812d2c0ea6dd651b0586be49e85ecca085, https://git.kernel.org/stable/c/01f51318feb626deee1d0c8a190198cd7857d599, and https://git.kernel.org/stable/c/b555912b9b21075e8298015f888ffe3ff60b1a97. Red Hat and SUSE users should monitor vendor channels for backported patches to supported kernel versions. Where immediate patching is not feasible and the rxrpc/AFS subsystem is not operationally required, unloading or blacklisting the rxrpc kernel module (blacklist rxrpc in /etc/modprobe.d/) eliminates the code path entirely, at the cost of losing AFS filesystem and RxRPC-based service functionality. Restricting kernel keyring access for unprivileged users via keyctl policy is a lighter-weight compensating control but does not eliminate the exposure if AFS users retain key add permissions.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31643 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy