CVE-2026-31634: Linux Kernel Reference Count Leak Flaw

CVE-2026-31634 Overview

CVE-2026-31634 is a reference count leak in the Linux kernel's rxrpc subsystem. The flaw resides in the rxrpc_server_keyring() function, which fails to check whether rx->securities is already set before assigning a new key reference. Repeated invocations cause kernel keyring references to leak, leading to resource exhaustion and potential denial of service on the affected host. The vulnerability requires local access with low privileges and no user interaction. It affects multiple Linux kernel branches, including 2.6.22 and 7.0 release candidates, and has been resolved across stable trees with seven backported patches.

Critical Impact
A local, low-privileged user can trigger repeated keyring reference leaks via the rxrpc interface, exhausting kernel resources and causing denial of service.

Affected Products

Linux Kernel 2.6.22
Linux Kernel 7.0 release candidates (rc1 through rc7)
Multiple stable kernel branches addressed by backports 12de9e0, 139c750, 8ee931c, 9ce36d2, c6d9ea2, f125846, and fc76d0b

Discovery Timeline

2026-04-24 - CVE-2026-31634 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31634

Vulnerability Analysis

The defect lives in the Linux kernel rxrpc networking module, which implements the AFS-style RxRPC transport protocol. The rxrpc_server_keyring() function associates a server-side keyring with an rxrpc socket so the kernel can validate inbound authenticated calls. The function assigns the resolved key to rx->securities without first checking whether a prior key reference is already stored in that field. When a caller invokes the operation multiple times on the same socket, the original key reference is overwritten and its refcount is never released.

Each leaked reference pins a struct key object in kernel memory. Sustained invocation by a local process steadily exhausts the keyring quota and kernel memory, producing the availability impact reflected in the CVSS vector. Confidentiality and integrity are not affected because the leak does not expose data or alter control flow.

Root Cause

The root cause is a missing precondition check in rxrpc_server_keyring(). The function should release any existing rx->securities reference, or skip assignment when one is present, before taking a new reference. Because neither path was implemented, every successful call after the first leaked the prior key. This pattern maps to the broader class of resource management errors tracked under [NVD-CWE-Other], specifically a reference count leak in kernel object lifecycle handling.

Attack Vector

Exploitation requires a local account on the affected host with permission to create AF_RXRPC sockets and invoke the setsockopt path that calls rxrpc_server_keyring(). An attacker repeatedly assigns server keyrings to the same socket to accumulate leaked references. Over time the leak depletes kernel keyring quotas or available memory, causing service degradation or a kernel-level denial of service. No remote vector exists and no user interaction is required.

The corresponding fix introduces a check for an existing rx->securities value before assignment, ensuring the prior reference is handled correctly. Refer to the upstream patches under git.kernel.org stable tree for the exact diff.

Detection Methods for CVE-2026-31634

Indicators of Compromise

Steady growth in kernel keyring usage reported by /proc/keys or /proc/key-users without a corresponding workload increase.
Processes repeatedly issuing setsockopt calls with RXRPC_SERVER_KEYRING on AF_RXRPC sockets.
Kernel log entries indicating keyring quota exhaustion or out-of-memory pressure originating from net/rxrpc.

Detection Strategies

Audit kernel versions on Linux fleets and flag hosts running unpatched branches listed in the NVD record for CVE-2026-31634.
Monitor for non-root processes that load AF_RXRPC sockets, which are uncommon outside of AFS deployments.
Correlate setsockopt syscall telemetry with growth in keyring reference counts to surface anomalous patterns.

Monitoring Recommendations

Collect kernel keyring statistics on a recurring interval and alert on sustained upward drift.
Forward auditd syscall events for socket(AF_RXRPC,...) and setsockopt to a centralized analytics platform for retrospective hunting.
Track memory pressure and OOM killer activations on hosts that expose rxrpc services such as kernel AFS clients.

How to Mitigate CVE-2026-31634

Immediate Actions Required

Apply the upstream stable kernel patches that introduce the rx->securities precondition check.
Inventory hosts running AF_RXRPC workloads, such as kernel AFS clients, and prioritize them for patching.
Restrict local shell access on multi-tenant systems until patched kernels are deployed.

Patch Information

The Linux kernel maintainers released seven backport commits covering the affected stable branches: 12de9e0, 139c750, 8ee931c, 9ce36d2, c6d9ea2, f125846, and fc76d0b. Distribution vendors will ship the fix in subsequent kernel updates. Apply vendor errata as they become available.

Workarounds

Unload the rxrpc kernel module on systems that do not require AFS or RxRPC functionality using modprobe -r rxrpc.
Blacklist the rxrpc module via /etc/modprobe.d/ to prevent automatic load until patched kernels are installed.
Reduce the per-user keyring quota with /proc/sys/kernel/keys/maxkeys to limit the blast radius of any leak attempt.

bash

# Configuration example
# Prevent rxrpc from loading on systems that do not need it
echo 'blacklist rxrpc' | sudo tee /etc/modprobe.d/disable-rxrpc.conf
sudo modprobe -r rxrpc

# Lower per-user keyring quota to constrain reference leaks
echo 200 | sudo tee /proc/sys/kernel/keys/maxkeys