Skip to main content

Linux Kernel CVE-2026-31676

| EUVDEUVD-2026-25643 HIGH
2026-04-25 Linux
Information Disclosure Linux
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but a timing-dependent race on duplicate/late packets warrants AC:H; impact is availability-only DoS (A:H, C:N/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:16 vuln.today
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
Apr 25, 2026 - 10:16 EUVD
EUVD ID Assigned
Apr 25, 2026 - 09:00 euvd
EUVD-2026-25643
CVE Published
Apr 25, 2026 - 08:46 nvd
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: only handle RESPONSE during service challenge

Only process RESPONSE packets while the service connection is still in RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before running response verification and security initialization, then use a local secured flag to decide whether to queue the secured-connection work after the state transition. This keeps duplicate or late RESPONSE packets from re-running the setup path and removes the unlocked post-transition state test.

AnalysisAI

Denial of service in the Linux kernel's rxrpc (AF_RXRPC) subsystem allows remote attackers to disrupt service-side RxRPC connections by sending duplicate or late RESPONSE packets that re-run the connection setup path. The flaw stems from an unlocked, post-transition state test that permitted RESPONSE processing outside the RXRPC_CONN_SERVICE_CHALLENGING window; the fix gates processing on that state under state_lock. No public exploit has been identified and EPSS probability is very low (0.02%), but any kernel exposing an rxrpc service (e.g., kafs/AFS) is potentially reachable over the network without authentication.

Technical ContextAI

AF_RXRPC is the kernel's implementation of the Rx RPC transport used primarily by kAFS (the in-kernel Andrew File System client/server) and other RxRPC services. During the RxRPC security handshake a service connection issues a CHALLENGE and expects a client RESPONSE; the connection sits in state RXRPC_CONN_SERVICE_CHALLENGING while awaiting it. The bug is a state-handling/race condition (root-cause class consistent with CWE-362 race condition / improper synchronization; NVD lists CWE as N/A): the original code tested connection state without holding state_lock and could process RESPONSE packets after the state had already transitioned, letting duplicate or late RESPONSEs re-drive response verification and security initialization. Per the CPE data the affected component is cpe:2.3:a:linux:linux (the Linux kernel), specifically the net/rxrpc code path.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux kernel - mainline 7.0 or stable 6.19.13 / 6.18.23 or later, and apply your distribution's update (Ubuntu users install the kernel from USN-8371-1: https://ubuntu.com/security/notices/USN-8371-1). The fix is also available as upstream commits on git.kernel.org (d0035e634dae83237ab7f5681eb52b2f65d0ceb8 and related). Where immediate patching is not possible, reduce exposure by disabling or not loading the rxrpc/kafs modules if unused (e.g., blacklist the rxrpc kernel module), and restrict network reachability of any AF_RXRPC service by firewalling the RxRPC/UDP ports (AFS typically UDP 7000-7009) to trusted clients only - the trade-off is that AFS/RxRPC connectivity to blocked peers will break. Because impact is availability-only, these controls are compensating measures until the kernel is updated, not a substitute for the patch.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31676 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy