CVE-2026-31670: Linux Kernel DOS Vulnerability in rfkill

CVE-2026-31670 Overview

CVE-2026-31670 is a denial-of-service vulnerability in the Linux kernel's net/rfkill subsystem. Userspace can trigger the creation of an unlimited number of rfkill events when the system is configured to generate them but no process consumes events from the rfkill file descriptor. The accumulated events grow without bound, leading to an out-of-memory condition on the host. The kernel maintainers resolved the issue by capping pending rfkill events at 1000 to prevent abuse. The flaw requires local, low-privilege access and impacts availability only.

Critical Impact
A local user can exhaust kernel memory by generating rfkill events faster than they are consumed, leading to system instability or denial of service.

Affected Products

Linux Kernel (mainline, multiple stable branches)
Linux Kernel 2.6.31 (introducing commit lineage)
Linux Kernel 7.0 release candidates rc1 through rc7

Discovery Timeline

2026-04-24 - CVE-2026-31670 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31670

Vulnerability Analysis

The vulnerability resides in the Linux kernel rfkill subsystem (net/rfkill), which exposes a character device for tracking the state of radio transmitters such as Wi-Fi and Bluetooth. When userspace opens the rfkill file descriptor, the kernel enqueues an event for every state change observed on the system. If the system generates events rapidly while no reader consumes them, the queue grows without any upper bound. This unbounded growth consumes kernel memory until allocation fails or the OOM killer is invoked. The condition can be reached by any local user with permission to open the rfkill device on a system configured to emit such events.

Root Cause

The root cause is missing flow control in the rfkill event delivery path. The original implementation appended events to a per-listener queue without enforcing a maximum length. The upstream fix bounds the pending event count at a fixed limit of 1000 entries, discarding or coalescing additional events once the cap is reached. This is a resource exhaustion flaw consistent with uncontrolled resource consumption patterns.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker opens the rfkill device, declines to read pending events, and induces or waits for state changes on radio interfaces. Repeated state transitions, which may be triggered through related kernel interfaces, accumulate in the per-descriptor queue. The attack does not yield code execution, privilege escalation, or information disclosure; the impact is limited to availability. No public proof-of-concept or exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is published. Refer to the upstream patches for the precise queue-bounding logic, including Kernel Git Commit 4bcd1615 and Kernel Git Commit ea245d78.

Detection Methods for CVE-2026-31670

Indicators of Compromise

Unexpected growth in kernel slab allocations associated with rfkill event structures.
Processes holding an open file descriptor on /dev/rfkill without issuing read() calls for extended periods.
OOM killer events in dmesg correlated with rfkill activity or radio state toggling.

Detection Strategies

Audit processes that open /dev/rfkill and monitor their read activity using lsof and strace sampling.
Track kernel memory consumption via /proc/slabinfo and alert on sustained growth without a corresponding workload change.
Correlate rapid Wi-Fi or Bluetooth state transitions with non-consuming rfkill listeners in host telemetry.

Monitoring Recommendations

Forward kernel logs and OOM events to a centralized logging pipeline for anomaly detection.
Establish baselines for rfkill-related syscall patterns on managed Linux endpoints and servers.
Alert on local users opening rfkill devices on systems where such access is not expected, particularly multi-tenant or kiosk environments.

How to Mitigate CVE-2026-31670

Immediate Actions Required

Apply the upstream kernel patches that bound the pending rfkill event queue at 1000 entries.
Update to a stable kernel release that incorporates the fix on all affected distributions.
Restrict access to /dev/rfkill to trusted users where the device is not required for normal operation.

Patch Information

The fix is distributed across multiple stable branches via the following commits: Kernel Git Commit 4bcd1615, Kernel Git Commit 673d2a3e, Kernel Git Commit 80ce4cb0, Kernel Git Commit 82843afc, Kernel Git Commit a8c26800, Kernel Git Commit b1e0c8d3, Kernel Git Commit e3842779, and Kernel Git Commit ea245d78. Consult your Linux distribution vendor for backported packages.

Workarounds

Tighten permissions on /dev/rfkill so that only privileged services can open it.
Disable the rfkill subsystem on systems that do not require radio state management.
Apply per-user resource limits and cgroup memory controls to contain runaway memory growth from local processes.

bash

# Restrict /dev/rfkill access to root only until patches are applied
chmod 600 /dev/rfkill
chown root:root /dev/rfkill

# Verify running kernel version after patching
uname -r