CVE-2026-31642: Linux Kernel Privilege Escalation Flaw

CVE-2026-31642 Overview

CVE-2026-31642 is an Infinite Loop vulnerability in the Linux kernel's rxrpc (Rx Remote Procedure Call) subsystem. The flaw exists in the call removal mechanism from the rxnet->calls list, where improper use of list_del_init() instead of list_del_rcu() can cause reading /proc/net/rxrpc/calls to enter an infinite loop. This vulnerability allows a local attacker with low privileges to cause a denial of service condition by triggering the infinite loop, effectively hanging the system or exhausting CPU resources.

Critical Impact
Local attackers can exploit improper RCU list handling in the Linux kernel rxrpc subsystem to trigger an infinite loop, causing denial of service through CPU exhaustion.

Affected Products

Linux Kernel version 4.13
Linux Kernel versions 7.0-rc1 through 7.0-rc7
Linux Kernel (various versions prior to the patch)

Discovery Timeline

April 24, 2026 - CVE-2026-31642 published to NVD
April 27, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31642

Vulnerability Analysis

This vulnerability stems from incorrect list manipulation in the rxrpc network subsystem. The rxrpc protocol implementation maintains a list of active calls in rxnet->calls. When removing entries from this list, the code originally used list_del_init(), which is not safe for RCU (Read-Copy-Update) protected data structures. RCU is a synchronization mechanism used extensively in the Linux kernel to allow concurrent read access without locks.

When list_del_init() is used instead of list_del_rcu(), a reader traversing the list through /proc/net/rxrpc/calls can encounter a corrupted list state. This happens because list_del_init() reinitializes the removed entry's pointers to point to itself, which can create a circular reference that causes an infinite loop when the list is being read concurrently.

The impact is primarily availability-focused, allowing local users to trigger a denial of service condition. No authentication bypass, code execution, or data exfiltration is possible through this vulnerability alone.

Root Cause

The root cause is the use of list_del_init() for removing rxrpc call entries from a RCU-protected list structure. This function is not RCU-safe and can corrupt the list traversal for concurrent readers. The fix involves:

Replacing list_del_init() with list_del_rcu() for proper RCU semantics
Modifying rxrpc_destroy_all_calls() to limit dumping to the first ten unexpected calls, eliminating the need for cond_resched() or list removal during cleanup
Updating rxrpc_put_call() to unconditionally delete calls from the list since it becomes the sole deletion point

Attack Vector

The attack requires local access to the system. An attacker with low-level user privileges can trigger the vulnerability by accessing /proc/net/rxrpc/calls while rxrpc calls are being removed from the list. The timing window where the race condition can be exploited depends on system load and rxrpc activity.

The exploitation scenario involves:

Establishing rxrpc connections to generate call entries in the kernel's call list
Initiating concurrent reads of /proc/net/rxrpc/calls while calls are being terminated
The race condition between list removal and list traversal triggers the infinite loop
The kernel thread reading the proc file becomes stuck, consuming CPU resources

No public exploit code is currently available for this vulnerability.

Detection Methods for CVE-2026-31642

Indicators of Compromise

Processes stuck in kernel space when reading /proc/net/rxrpc/calls
Unexplained high CPU utilization by kernel threads related to proc filesystem access
System hangs or unresponsiveness when rxrpc network activity occurs
Kernel log messages indicating issues with rxrpc call cleanup

Detection Strategies

Monitor for processes with excessive CPU time in kernel space, particularly those accessing proc filesystem entries
Implement kernel auditing to track access patterns to /proc/net/rxrpc/calls
Use kernel debugging tools like ftrace to monitor rxrpc subsystem activity for anomalous behavior
Deploy endpoint detection solutions capable of identifying denial of service patterns

Monitoring Recommendations

Enable kernel soft lockup detection to identify infinite loop conditions early
Monitor system CPU metrics for unusual kernel-mode CPU consumption
Configure alerts for processes that remain in uninterruptible sleep states for extended periods
Review audit logs for repeated access attempts to rxrpc proc entries

How to Mitigate CVE-2026-31642

Immediate Actions Required

Apply the kernel patches from the official stable kernel branches immediately
Restrict access to /proc/net/rxrpc/calls if rxrpc functionality is not required
Consider disabling the rxrpc kernel module (CONFIG_AF_RXRPC) if not needed for your workload
Monitor systems for signs of exploitation until patches can be applied

Patch Information

Linux kernel maintainers have released patches across multiple stable branches. The following commits address this vulnerability:

Update to the latest stable kernel version that includes these patches. Verify the patch status by checking the commit history of your kernel source or consulting your distribution's security advisories.

Workarounds

Disable the rxrpc kernel module if AFS (Andrew File System) functionality is not required: modprobe -r rxrpc
Restrict read access to /proc/net/rxrpc/calls using file permissions or SELinux/AppArmor policies
Implement resource limits to prevent CPU exhaustion from affecting critical system services
Use containerization with restricted capabilities to limit access to kernel proc interfaces

bash

# Disable rxrpc module if not needed
echo "blacklist rxrpc" >> /etc/modprobe.d/blacklist-rxrpc.conf
modprobe -r rxrpc

# Restrict proc access (if module cannot be removed)
chmod 400 /proc/net/rxrpc/calls