CVE-2026-31642: Linux Kernel Privilege Escalation Flaw

CVE-2026-31642 Overview

CVE-2026-31642 is an Infinite Loop vulnerability in the Linux kernel's rxrpc (Rx Remote Procedure Call) subsystem. The flaw exists in the call removal mechanism from the rxnet->calls list, where improper use of list_del_init() instead of list_del_rcu() can cause reading /proc/net/rxrpc/calls to enter an infinite loop. This vulnerability allows a local attacker with low privileges to cause a denial of service condition by triggering the infinite loop, effectively hanging the system or exhausting CPU resources.

Critical Impact

Local attackers can exploit improper RCU list handling in the Linux kernel rxrpc subsystem to trigger an infinite loop, causing denial of service through CPU exhaustion.

Affected Products

• Linux Kernel version 4.13
• Linux Kernel versions 7.0-rc1 through 7.0-rc7
• Linux Kernel (various versions prior to the patch)

Discovery Timeline

• April 24, 2026 - CVE-2026-31642 published to NVD
• April 27, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31642

Vulnerability Analysis

This vulnerability stems from incorrect list manipulation in the rxrpc network subsystem. The rxrpc protocol implementation maintains a list of active calls in rxnet->calls. When removing entries from this list, the code originally used list_del_init(), which is not safe for RCU (Read-Copy-Update) protected data structures. RCU is a synchronization mechanism used extensively in the Linux kernel to allow concurrent read access without locks.

When list_del_init() is used instead of list_del_rcu(), a reader traversing the list through /proc/net/rxrpc/calls can encounter a corrupted list state. This happens because list_del_init() reinitializes the removed entry's pointers to point to itself, which can create a circular reference that causes an infinite loop when the list is being read concurrently.

The impact is primarily availability-focused, allowing local users to trigger a denial of service condition. No authentication bypass, code execution, or data exfiltration is possible through this vulnerability alone.

Root Cause

The root cause is the use of list_del_init() for removing rxrpc call entries from a RCU-protected list structure. This function is not RCU-safe and can corrupt the list traversal for concurrent readers. The fix involves:

1. Replacing list_del_init() with list_del_rcu() for proper RCU semantics
2. Modifying rxrpc_destroy_all_calls() to limit dumping to the first ten unexpected calls, eliminating the need for cond_resched() or list removal during cleanup
3. Updating rxrpc_put_call() to unconditionally delete calls from the list since it becomes the sole deletion point

Attack Vector

The attack requires local access to the system. An attacker with low-level user privileges can trigger the vulnerability by accessing /proc/net/rxrpc/calls while rxrpc calls are being removed from the list. The timing window where the race condition can be exploited depends on system load and rxrpc activity.

The exploitation scenario involves:

1. Establishing rxrpc connections to generate call entries in the kernel's call list
2. Initiating concurrent reads of /proc/net/rxrpc/calls while calls are being terminated
3. The race condition between list removal and list traversal triggers the infinite loop
4. The kernel thread reading the proc file becomes stuck, consuming CPU resources

No public exploit code is currently available for this vulnerability.

Detection Methods for CVE-2026-31642

Indicators of Compromise

• Processes stuck in kernel space when reading /proc/net/rxrpc/calls
• Unexplained high CPU utilization by kernel threads related to proc filesystem access
• System hangs or unresponsiveness when rxrpc network activity occurs
• Kernel log messages indicating issues with rxrpc call cleanup

Detection Strategies

• Monitor for processes with excessive CPU time in kernel space, particularly those accessing proc filesystem entries
• Implement kernel auditing to track access patterns to /proc/net/rxrpc/calls
• Use kernel debugging tools like ftrace to monitor rxrpc subsystem activity for anomalous behavior
• Deploy endpoint detection solutions capable of identifying denial of service patterns

Monitoring Recommendations

• Enable kernel soft lockup detection to identify infinite loop conditions early
• Monitor system CPU metrics for unusual kernel-mode CPU consumption
• Configure alerts for processes that remain in uninterruptible sleep states for extended periods
• Review audit logs for repeated access attempts to rxrpc proc entries

How to Mitigate CVE-2026-31642

Immediate Actions Required

• Apply the kernel patches from the official stable kernel branches immediately
• Restrict access to /proc/net/rxrpc/calls if rxrpc functionality is not required
• Consider disabling the rxrpc kernel module (CONFIG_AF_RXRPC) if not needed for your workload
• Monitor systems for signs of exploitation until patches can be applied

Patch Information

Linux kernel maintainers have released patches across multiple stable branches. The following commits address this vulnerability:

• Kernel Git Commit 146d4ab94cf1
• Kernel Git Commit 3be718f65968
• Kernel Git Commit 93fc15be44a3
• Kernel Git Commit ac5f54691be0
• Kernel Git Commit c63abf25203b

Update to the latest stable kernel version that includes these patches. Verify the patch status by checking the commit history of your kernel source or consulting your distribution's security advisories.

Workarounds

• Disable the rxrpc kernel module if AFS (Andrew File System) functionality is not required: modprobe -r rxrpc
• Restrict read access to /proc/net/rxrpc/calls using file permissions or SELinux/AppArmor policies
• Implement resource limits to prevent CPU exhaustion from affecting critical system services
• Use containerization with restricted capabilities to limit access to kernel proc interfaces

# Disable rxrpc module if not needed
echo "blacklist rxrpc" >> /etc/modprobe.d/blacklist-rxrpc.conf
modprobe -r rxrpc

# Restrict proc access (if module cannot be removed)
chmod 400 /proc/net/rxrpc/calls