Skip to main content

Linux Kernel CVE-2026-31670

| EUVDEUVD-2026-25563 MEDIUM
2026-04-24 Linux GHSA-8qfv-g522-p5wr
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required; only availability impacted via OOM exhaustion; no confidentiality, integrity, or scope-change effects.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:23 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:10 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25563
CVE Published
Apr 24, 2026 - 14:45 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: rfkill: prevent unlimited numbers of rfkill events from being created

Userspace can create an unlimited number of rfkill events if the system is so configured, while not consuming them from the rfkill file descriptor, causing a potential out of memory situation. Prevent this from bounding the number of pending rfkill events at a "large" number (i.e. 1000) to prevent abuses like this.

AnalysisAI

Local low-privileged users can exhaust system memory on Linux systems by generating unbounded rfkill events without consuming them from the rfkill file descriptor, resulting in a potential out-of-memory condition and system crash. Affected kernel versions span a wide range across multiple stable branches, with fixes backported to 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0. No public exploit code or active exploitation has been identified; the EPSS score of 0.02% (7th percentile) reflects minimal real-world exploitation interest at time of analysis.

Technical ContextAI

The Linux rfkill subsystem (net/rfkill) manages radio frequency kill switches for wireless hardware such as Wi-Fi and Bluetooth adapters, exposing a character device at /dev/rfkill for userspace interaction. The vulnerability resides in the event queue mechanism: when userspace opens the rfkill file descriptor but does not read events, the kernel continued to allocate memory for each queued event without any upper bound. This represents a resource allocation without throttling pattern (consistent with CWE-770), where a malicious or buggy local process can trigger a flood of rfkill state-change events faster than they are consumed, exhausting available system memory. The fix introduces a hard cap of 1000 pending rfkill events. Affected CPEs cover linux:linux across all versions prior to the respective stable-branch patch commits listed in the kernel stable repository.

RemediationAI

Upgrade to the patched kernel version for the relevant stable branch: 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, or 7.0. Upstream fix commits are available at https://git.kernel.org/stable/c/4bcd1615a4e2a185ae9edd27b4143d7dfa7134f4 and related stable backports. Ubuntu users should apply the updates referenced in USN-8567-1. For Siemens embedded deployments, consult SSA-019113 and SSA-082556. If immediate patching is not feasible, restrict access to /dev/rfkill via udev rules (e.g., MODE='0600', GROUP='root') to prevent unprivileged users from opening the device - note this will break legitimate wireless management tools (NetworkManager, iwd) for non-root users and should be weighed accordingly. Alternatively, if wireless functionality is unused, disable CONFIG_RFKILL at the kernel level or blacklist the rfkill module (modprobe.d blacklist rfkill), accepting that hardware RF kill-switch support will be unavailable.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31670 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy