CVE-2026-31638

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31638
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Only put the call ref if one was acquired rxrpc_input_packet_on_conn() can process a to-client packet after the current client call on the channel has already been torn down. In that case chan->call is NULL, rxrpc_try_get_call() returns NULL and there is no reference to drop. The client-side implicit-end error path does not account for that and unconditionally calls rxrpc_put_call(). This turns a protocol error path into a kernel crash instead of rejecting the packet. Only drop the call reference if one was actually acquired. Keep the existing protocol error handling unchanged.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0c156aff8a2d4fa0d61db7837641975cf0e5452d Patch
https://git.kernel.org/stable/c/6331f1b24a3e85465f6454e003a3e6c22005a5c5 Patch
https://git.kernel.org/stable/c/8299ca146489664e3c0c90a3b8900d8335b1ede4 Patch
https://git.kernel.org/stable/c/9fb09861e2b8d1abfe2efaf260c9f1d30080ea38 Patch
https://git.kernel.org/stable/c/b8f66447448d6c305a51413a67ec8ed26aa7d1dd Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
History

27 Apr 2026, 20:20

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0c156aff8a2d4fa0d61db7837641975cf0e5452d - () https://git.kernel.org/stable/c/0c156aff8a2d4fa0d61db7837641975cf0e5452d - Patch
References () https://git.kernel.org/stable/c/6331f1b24a3e85465f6454e003a3e6c22005a5c5 - () https://git.kernel.org/stable/c/6331f1b24a3e85465f6454e003a3e6c22005a5c5 - Patch
References () https://git.kernel.org/stable/c/8299ca146489664e3c0c90a3b8900d8335b1ede4 - () https://git.kernel.org/stable/c/8299ca146489664e3c0c90a3b8900d8335b1ede4 - Patch
References () https://git.kernel.org/stable/c/9fb09861e2b8d1abfe2efaf260c9f1d30080ea38 - () https://git.kernel.org/stable/c/9fb09861e2b8d1abfe2efaf260c9f1d30080ea38 - Patch
References () https://git.kernel.org/stable/c/b8f66447448d6c305a51413a67ec8ed26aa7d1dd - () https://git.kernel.org/stable/c/b8f66447448d6c305a51413a67ec8ed26aa7d1dd - Patch
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CWE CWE-476

27 Apr 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

24 Apr 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-24 15:16

Updated : 2026-04-27 20:20

NVD link : CVE-2026-31638

Mitre link : CVE-2026-31638

CVE.ORG link : CVE-2026-31638

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference