Skip to main content

Linux Kernel EUVDEUVD-2026-25525

| CVE-2026-31632 MEDIUM
Memory Leak (CWE-401)
2026-04-24 Linux GHSA-79jm-hgj4-5mpx
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access and low privilege required to reach AFS RxGK path; impact is memory exhaustion only, with no data exposure or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:51 vuln.today
CVSS changed
Apr 27, 2026 - 20:37 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:30 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25525
CVE Published
Apr 24, 2026 - 14:44 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix leak of rxgk context in rxgk_verify_response()

Fix rxgk_verify_response() to clean up the rxgk context it creates.

AnalysisAI

Memory exhaustion in the Linux kernel's rxrpc/rxgk subsystem allows a local low-privileged attacker to cause a denial-of-service condition by triggering a resource leak in rxgk_verify_response(), where allocated rxgk authentication context objects are never released. The flaw is confined to systems actively using AFS with RxGK GSS-based authentication, a non-default configuration absent from the vast majority of Linux deployments. No public exploit code exists and exploitation probability is extremely low (EPSS 0.02%), though patched stable kernel versions 6.18.23, 6.19.13, and 7.0 are available.

Technical ContextAI

The vulnerability resides in the rxrpc (Reliable Datagram Sockets over RPC) subsystem, specifically the rxgk module implementing RxGK - a GSS-API-based security mechanism for AFS (Andrew File System) transport authentication. CWE-401 (Missing Release of Memory After Effective Lifetime) identifies the root cause: rxgk_verify_response() allocates an rxgk security context to process inbound authentication responses but fails to free this allocation before returning on at least one code path, producing a kernel memory leak. The CPE data (cpe:2.3:a:linux:linux:*) confirms the flaw spans kernel builds from the introducing commit 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a onward. Because RxGK is only active when the kafs (kAFS) kernel module is loaded and AFS is configured with RxGK authentication, the vulnerable code is unreachable on the overwhelming majority of Linux hosts. The 'Information Disclosure' tag present in the intelligence feed conflicts with both the CVSS C:N metric and the CWE-401 classification - it appears to be a feed-level misclassification and should be disregarded in favor of the authoritative CVSS vector and kernel commit description.

RemediationAI

Upgrade to a patched kernel release: 6.18.23 or later on the 6.18.x branch, 6.19.13 or later on the 6.19.x branch, or 7.0 on mainline, using the stable commits referenced above. Red Hat and SUSE users should apply distribution-specific kernel errata as they are published and monitor vendor security portals for advisories. For environments that cannot immediately patch, an effective compensating control is to ensure the kafs kernel module is not loaded (run 'lsmod | grep kafs' to confirm); if AFS is not in use, blacklisting the kafs module via /etc/modprobe.d prevents the rxgk code path from ever executing, eliminating exposure with no service impact for non-AFS workloads. Disabling kafs on a host actively using AFS would disrupt AFS mounts and should only be done after confirming AFS is not a dependency. No additional workarounds for active AFS deployments are documented in available references.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25525 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy