CVE-2026-31640: Linux Kernel Privilege Escalation Flaw

CVE-2026-31640 Overview

CVE-2026-31640 is a high-severity flaw in the Linux kernel's rxrpc networking subsystem. The vulnerability resides in rxrpc_post_response(), where the function compares the challenge serial number against the wrong socket buffer (skb). Instead of inspecting the cached response packet's private data, the code reads the incoming packet, causing the serial comparison to always evaluate false. This logic defect breaks correct handling of queued RESP challenge packets and can be triggered remotely over the network. The issue affects Linux kernel 6.16 and the 7.0 release candidates (rc1 through rc7).

Critical Impact
Remote attackers can trigger incorrect packet handling in the rxrpc subsystem, leading to availability impact on affected Linux kernels without requiring authentication or user interaction.

Affected Products

Linux Kernel 6.16
Linux Kernel 7.0-rc1 through 7.0-rc7
Distributions shipping the affected upstream rxrpc code

Discovery Timeline

2026-04-24 - CVE-2026-31640 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31640

Vulnerability Analysis

The defect resides in rxrpc_post_response(), a function in the kernel's RxRPC implementation responsible for handling RESP (response) packets during authenticated call setup. When a new RESP arrives, the function should decide whether to replace a previously cached response with a newer one based on the challenge serial number.

The code reads the challenge serial from the newer incoming packet's private data instead of the cached older packet. Because both sides of the comparison effectively reference the same packet, the conditional always returns false. As a result, the kernel never substitutes the newer response and may also leak the unused skb, consistent with the assigned weakness classification [CWE-401] (Missing Release of Memory after Effective Lifetime).

The upstream fix corrects the comparison to use the older packet, substitutes the new packet in place of the old one when newer, and releases whichever packet is not retained.

Root Cause

The root cause is an incorrect pointer reference in the queued RESP handling logic. The developer used the new packet's private data on both sides of the serial-number comparison, so the conditional has no meaningful effect and the cached response cannot be updated correctly.

Attack Vector

The vulnerability is reachable over the network through the RxRPC protocol, which is used by AFS file system clients. An unauthenticated attacker capable of sending crafted RxRPC packets to a vulnerable host can repeatedly trigger the faulty code path, exhausting kernel memory through leaked socket buffers and degrading system availability.

No verified proof-of-concept exploitation code has been published. The vulnerability mechanism is described in prose; see the upstream kernel patch for the precise change.

Detection Methods for CVE-2026-31640

Indicators of Compromise

Unexplained growth in kernel slab memory associated with skbuff allocations on hosts running RxRPC or AFS workloads.
Repeated inbound RxRPC traffic carrying RESP packets with varying challenge serial numbers from untrusted sources.
Kernel logs showing degraded RxRPC call setup or stalled AFS mount operations.

Detection Strategies

Inventory Linux hosts running kernel versions 6.16 or 7.0-rc1 through 7.0-rc7 using uname -r and configuration management telemetry.
Monitor for kafs or rxrpc modules loaded on systems exposed to untrusted networks.
Use vulnerability scanners with current NVD feeds to flag CVE-2026-31640 against the affected kernel package versions.

Monitoring Recommendations

Track kernel memory consumption trends with /proc/meminfo and slab metrics to identify gradual exhaustion.
Alert on inbound UDP traffic to port 7000-7009 (RxRPC range) originating from untrusted networks.
Correlate kernel oops or watchdog events with periods of elevated RxRPC packet rates.

How to Mitigate CVE-2026-31640

Immediate Actions Required

Upgrade the Linux kernel to a release containing the upstream fix referenced by commits 20386e7f, 9132b1a7, or b33f5741.
Restrict inbound RxRPC traffic at network boundaries to trusted AFS clients only.
Unload the rxrpc and kafs kernel modules on systems that do not require AFS connectivity.

Patch Information

The vulnerability is resolved by three upstream commits in the stable kernel tree: Kernel Patch 20386e7, Kernel Patch 9132b1a, and Kernel Patch b33f574. The fix switches the comparison to the older cached packet, substitutes the new packet when it is in fact newer, and releases the packet that is not retained. Apply the kernel update provided by your Linux distribution as soon as it is available.

Workarounds

Block UDP traffic to RxRPC ports at perimeter firewalls when AFS is not in use.
Disable autoload of the rxrpc module by adding blacklist rxrpc to /etc/modprobe.d/ configuration.
Limit kernel module loading to administrators via kernel.modules_disabled=1 after boot on hardened hosts.

bash

# Configuration example
# Prevent rxrpc module from loading on systems that do not require AFS
echo 'blacklist rxrpc' | sudo tee /etc/modprobe.d/disable-rxrpc.conf
echo 'blacklist kafs'  | sudo tee -a /etc/modprobe.d/disable-rxrpc.conf
sudo depmod -a

# Verify the module is not loaded
lsmod | grep -E 'rxrpc|kafs'