Skip to main content

Linux Kernel EUVDEUVD-2026-25535

| CVE-2026-31642 MEDIUM
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-04-24 Linux GHSA-q4rh-73g2-jf4j
Denial Of Service Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Requires rxrpc module active and concurrent call teardown timing, justifying AC:H over the NVD-assigned AC:L; all other metrics match the supplied vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:50 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:20 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25535
CVE Published
Apr 24, 2026 - 14:44 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix call removal to use RCU safe deletion

Fix rxrpc call removal from the rxnet->calls list to use list_del_rcu() rather than list_del_init() to prevent stuffing up reading /proc/net/rxrpc/calls from potentially getting into an infinite loop.

This, however, means that list_empty() no longer works on an entry that's been deleted from the list, making it harder to detect prior deletion. Fix this by:

Firstly, make rxrpc_destroy_all_calls() only dump the first ten calls that are unexpectedly still on the list. Limiting the number of steps means there's no need to call cond_resched() or to remove calls from the list here, thereby eliminating the need for rxrpc_put_call() to check for that.

rxrpc_put_call() can then be fixed to unconditionally delete the call from the list as it is the only place that the deletion occurs.

AnalysisAI

Infinite-loop denial of service in the Linux kernel's rxrpc subsystem allows a local low-privileged user to hang a process indefinitely by reading /proc/net/rxrpc/calls while concurrent rxrpc call teardown occurs. The root cause is use of list_del_init() instead of the RCU-safe list_del_rcu() during call removal from rxnet->calls, leaving the list in a state that confuses RCU readers into endless traversal. No public exploit exists and EPSS sits at the 5th percentile, reflecting the combination of local-only access and the niche deployment footprint of rxrpc.

Technical ContextAI

The rxrpc subsystem (RX Remote Procedure Call, used primarily by the AFS/OpenAFS distributed filesystem) maintains a linked list of active calls at rxnet->calls and exposes it via /proc/net/rxrpc/calls. The kernel's Read-Copy-Update (RCU) mechanism allows lockless list traversal by readers, but only if deletions are performed with list_del_rcu(), which defers pointer cleanup until all concurrent readers finish their grace period. The code incorrectly used list_del_init(), which immediately zeroes the next/prev pointers; an RCU reader traversing the list at that instant sees a self-referencing entry and spins forever. CWE-835 (Loop with Unreachable Exit Condition) captures this precisely. The CPE cpe:2.3:a:linux:linux confirms the affected product is the upstream Linux kernel tree, introduced at commit 2baec2c3f854d1f79c7bb28386484e144e864a14 (kernel 4.13 era when modern rxrpc was merged).

RemediationAI

The primary remediation is upgrading the running kernel to a patched stable release: 6.6.135, 6.12.82, 6.18.23, 6.19.13, or 7.0 as appropriate for the distribution series in use. Upstream patch commits are available at https://git.kernel.org/stable/c/93fc15be44a35b8e3c58d0238ac0d9b7c53465ff and sibling commits. Ubuntu users should apply the packages described in https://ubuntu.com/security/notices/USN-8567-1. If an immediate kernel upgrade is not feasible and the system does not require rxrpc/AFS functionality, the rxrpc kernel module can be blacklisted (add 'blacklist rxrpc' to /etc/modprobe.d/blacklist.conf and reboot) to eliminate the attack surface entirely; this will break AFS clients and servers but has no impact on the vast majority of deployments. Restricting read access to /proc/net/rxrpc/calls via filesystem permissions is an additional partial mitigation but does not address the underlying race for privileged readers.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25535 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy