CVE-2026-31638: Linux Kernel Privilege Escalation Flaw

CVE-2026-31638 Overview

CVE-2026-31638 is a NULL pointer dereference vulnerability [CWE-476] in the Linux kernel's rxrpc networking subsystem. The flaw exists in rxrpc_input_packet_on_conn(), which can process a to-client packet after the current client call on the channel has already been torn down. When chan->call is NULL, rxrpc_try_get_call() returns NULL and no reference is acquired, but the client-side implicit-end error path unconditionally calls rxrpc_put_call(). This transforms a protocol error into a kernel crash. Remote attackers can trigger the condition by sending crafted RxRPC packets over the network, resulting in denial of service against affected hosts.

Critical Impact
Remote, unauthenticated attackers can crash Linux systems running affected kernels by sending malformed RxRPC packets, producing a high-availability impact without compromising confidentiality or integrity.

Affected Products

Linux Kernel 6.2 (release)
Linux Kernel 7.0 release candidates rc1 through rc7
Linux Kernel stable branches prior to the fix commits listed in the kernel.org advisories

Discovery Timeline

2026-04-24 - CVE-2026-31638 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31638

Vulnerability Analysis

The rxrpc subsystem implements the RxRPC transport protocol used primarily by AFS (Andrew File System) clients in the Linux kernel. The vulnerability resides in the client-side packet input path within rxrpc_input_packet_on_conn(). This function processes incoming packets routed to a specific connection and may invoke an implicit-end error path when protocol anomalies are detected.

During normal operation, the function calls rxrpc_try_get_call() to acquire a reference to the active call on a channel. When the call has already been torn down, chan->call is NULL and rxrpc_try_get_call() returns NULL. No reference is taken in this case.

The defective error path does not check the return value before calling rxrpc_put_call(). Releasing a reference that was never acquired dereferences a NULL pointer in kernel context, triggering an oops and likely panicking the host depending on panic_on_oops configuration.

Root Cause

The root cause is a missing NULL check on the return value of rxrpc_try_get_call() in the implicit-end error path. The code assumed a reference would always be acquired, but the channel state can legitimately have no active call when a stale to-client packet arrives.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted RxRPC packets to a Linux host with the rxrpc module loaded, timing the packets to arrive after the targeted channel's client call has been torn down. The malformed packet drives execution into the implicit-end error path, triggering the NULL dereference and crashing the kernel.

The vulnerability is reachable on systems that use Kerberos-authenticated AFS clients or any workload that loads the rxrpc module. See the upstream commits referenced in the advisories for the precise call flow.

Detection Methods for CVE-2026-31638

Indicators of Compromise

Kernel oops or panic messages referencing rxrpc_put_call, rxrpc_input_packet_on_conn, or rxrpc_try_get_call in dmesg or /var/log/kern.log
Unexpected reboots or kernel BUG traces on hosts running AFS clients or other RxRPC-dependent workloads
Inbound RxRPC traffic (UDP port 7000 and surrounding ports) from untrusted sources directed at kernels prior to the fix

Detection Strategies

Inventory kernel versions across the fleet and flag hosts matching the vulnerable ranges identified in the kernel.org commits
Correlate kernel crash telemetry with inbound UDP traffic on RxRPC ports to surface exploitation attempts
Monitor for repeated lsmod evidence of the rxrpc module being loaded on hosts that do not require AFS

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized logging or SIEM platform for correlation
Alert on kernel panics, BUG: strings, and reboots that coincide with external network activity
Track lsmod | grep rxrpc results across the estate to identify exposed systems

How to Mitigate CVE-2026-31638

Immediate Actions Required

Apply the upstream kernel fix from the referenced kernel.org commits: Kernel Git Commit 0c156af, Kernel Git Commit 6331f1b, Kernel Git Commit 8299ca1, Kernel Git Commit 9fb0986, and Kernel Git Commit b8f6644
Update to a distribution kernel package that includes the fix once published by your vendor
Restrict inbound RxRPC traffic at network and host firewalls on systems that do not require AFS connectivity

Patch Information

The fix modifies the implicit-end error path in rxrpc_input_packet_on_conn() so that rxrpc_put_call() is only invoked when rxrpc_try_get_call() actually returned a valid reference. Existing protocol error handling is preserved. Distribution vendors are expected to backport the patches to supported stable kernel branches.

Workarounds

Unload and blacklist the rxrpc kernel module on hosts that do not use AFS or other RxRPC-based services
Block UDP traffic destined for RxRPC ports (notably 7000) at perimeter and host firewalls
Limit exposure of AFS clients to trusted network segments until kernels are patched

bash

# Disable the rxrpc module on hosts that do not require it
sudo modprobe -r rxrpc
echo "blacklist rxrpc" | sudo tee /etc/modprobe.d/blacklist-rxrpc.conf

# Drop inbound RxRPC traffic at the host firewall (nftables example)
sudo nft add rule inet filter input udp dport 7000 drop