CVE-2026-31639: Linux Kernel Information Disclosure Flaw

CVE-2026-31639 Overview

A memory leak vulnerability has been identified in the Linux kernel's rxrpc subsystem. When creating a client call in rxrpc_alloc_client_call(), the code obtains a reference to a key that is never properly cleaned up when the call is destroyed. This leads to key reference count leaks that can accumulate over time, potentially causing system instability and denial of service conditions.

Critical Impact
Local attackers with low privileges can cause resource exhaustion through accumulated key reference leaks, leading to denial of service conditions affecting system availability.

Affected Products

Linux Kernel versions prior to patched releases
Linux Kernel 6.2
Linux Kernel 7.0 Release Candidates (rc1 through rc7)

Discovery Timeline

2026-04-24 - CVE-2026-31639 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31639

Vulnerability Analysis

This vulnerability represents a Memory Leak in the Linux kernel's rxrpc (Reliable eXtended Remote Procedure Call) protocol implementation. The rxrpc subsystem is used for communication protocols like AFS (Andrew File System), and proper resource management is critical for system stability.

The flaw occurs in the client call allocation pathway where key references are acquired but never released. Each time a client call is created, a reference to the associated key is obtained. However, the corresponding cleanup code in the call destruction path fails to decrement the reference counter, causing the key object to persist indefinitely in kernel memory.

The impact manifests as an ever-growing key reference counter that can be observed through /proc/keys. Before the patch, affected systems show elevated reference counts for AFS-related keys, while properly patched systems correctly remove invalidated keys when the associated code exits.

Root Cause

The root cause lies in the missing cleanup operation in rxrpc_destroy_call(). When rxrpc_alloc_client_call() obtains a reference to the key via call->key, it increments the key's reference counter. However, the corresponding rxrpc_destroy_call() function does not include the necessary code to release this reference by freeing call->key, resulting in leaked key references that accumulate over the lifetime of the system.

Attack Vector

This vulnerability requires local access to the system with low-privilege user permissions. An attacker could potentially exploit this by repeatedly triggering rxrpc client call allocations, causing key reference counts to grow unbounded. Over extended periods or through rapid iteration, this could lead to:

Memory pressure as key objects remain allocated
Kernel resource exhaustion
System degradation and potential denial of service

The vulnerability is exploitable without user interaction, though the attack vector is limited to local access, reducing the overall attack surface.

Detection Methods for CVE-2026-31639

Indicators of Compromise

Elevated key reference counters visible in /proc/keys for AFS-related keys (e.g., afs@54321)
Anomalously high key usage counters that continue to grow without corresponding releases
System memory pressure related to kernel key subsystem allocations

Detection Strategies

Monitor /proc/keys output for keys with unusually high reference counters that do not decrease over time
Implement kernel audit rules to track rxrpc-related system calls and key operations
Use kernel memory profiling tools to detect gradual memory leaks in the key management subsystem
Deploy system monitoring for abnormal kernel memory consumption patterns

Monitoring Recommendations

Establish baseline key reference counts for AFS-related keys and alert on significant deviations
Configure periodic health checks that examine /proc/keys for stale entries with elevated counters
Implement logging for rxrpc subsystem activity to correlate with potential exploitation attempts

How to Mitigate CVE-2026-31639

Immediate Actions Required

Apply the latest stable kernel patches that include the fix for rxrpc_destroy_call()
Prioritize patching on systems utilizing AFS or other rxrpc-dependent services
Monitor affected systems for signs of resource exhaustion until patches can be applied
Consider temporarily disabling rxrpc-dependent services if patching is delayed and risk is elevated

Patch Information

Multiple stable kernel commits have been released to address this vulnerability. The fix adds the necessary cleanup code to rxrpc_destroy_call() to properly release the key reference obtained during call allocation.

Official patches are available via the following kernel commits:

Workarounds

If immediate patching is not feasible, consider disabling the rxrpc kernel module if not required for operations
Implement system reboots on a scheduled basis to clear accumulated key reference leaks
Restrict local access to reduce the attack surface for potential exploitation
Monitor /proc/keys actively and restart affected services if reference counts reach concerning levels

bash

# Check for elevated key reference counts
cat /proc/keys | grep afs

# Disable rxrpc module if not in use (temporary workaround)
modprobe -r rxrpc
echo "blacklist rxrpc" >> /etc/modprobe.d/blacklist-rxrpc.conf