{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31634", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.125Z", "datePublished": "2026-04-24T14:44:49.307Z", "dateUpdated": "2026-05-11T22:12:36.423Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:12:36.423Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix reference count leak in rxrpc_server_keyring()\n\nThis patch fixes a reference count leak in rxrpc_server_keyring()\nby checking if rx->securities is already set."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/server_key.c"], "versions": [{"version": "17926a79320afa9b95df6b977b40cca6d8713cea", "lessThan": "fc76d0bd00850b7372f0a4a319c0c60f80487632", "status": "affected", "versionType": "git"}, {"version": "17926a79320afa9b95df6b977b40cca6d8713cea", "lessThan": "c6d9ea26cf8756ad6f162578e94a5f82f6fae3c2", "status": "affected", "versionType": "git"}, {"version": "17926a79320afa9b95df6b977b40cca6d8713cea", "lessThan": "9ce36d28f67c2a477a7e2f03480de3f6783fb363", "status": "affected", "versionType": "git"}, {"version": "17926a79320afa9b95df6b977b40cca6d8713cea", "lessThan": "12de9e0e0b0b7058be7dfb8a5927eb565bc25780", "status": "affected", "versionType": "git"}, {"version": "17926a79320afa9b95df6b977b40cca6d8713cea", "lessThan": "8ee931c3cd97f1c42b4fbf057f04b9dae45dfb7a", "status": "affected", "versionType": "git"}, {"version": "17926a79320afa9b95df6b977b40cca6d8713cea", "lessThan": "139c750bf06649097d98b0bc41e2a678b4627e27", "status": "affected", "versionType": "git"}, {"version": "17926a79320afa9b95df6b977b40cca6d8713cea", "lessThan": "f125846ee79fcae537a964ce66494e96fa54a6de", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/server_key.c"], "versions": [{"version": "2.6.22", "status": "affected"}, {"version": "0", "lessThan": "2.6.22", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.169", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.135", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.82", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.23", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.13", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.1.169"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.6.135"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.12.82"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.18.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.19.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fc76d0bd00850b7372f0a4a319c0c60f80487632"}, {"url": "https://git.kernel.org/stable/c/c6d9ea26cf8756ad6f162578e94a5f82f6fae3c2"}, {"url": "https://git.kernel.org/stable/c/9ce36d28f67c2a477a7e2f03480de3f6783fb363"}, {"url": "https://git.kernel.org/stable/c/12de9e0e0b0b7058be7dfb8a5927eb565bc25780"}, {"url": "https://git.kernel.org/stable/c/8ee931c3cd97f1c42b4fbf057f04b9dae45dfb7a"}, {"url": "https://git.kernel.org/stable/c/139c750bf06649097d98b0bc41e2a678b4627e27"}, {"url": "https://git.kernel.org/stable/c/f125846ee79fcae537a964ce66494e96fa54a6de"}], "title": "rxrpc: fix reference count leak in rxrpc_server_keyring()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3CA3003D-15D3-4188-ADEA-9A0A4C5759FD", "versionEndExcluding": "5.15.203", "versionStartIncluding": "2.6.22.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DBEC0E5D-641C-4E98-A6D9-5799B10CE451", "versionEndExcluding": "6.1.169", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "15C1A1B2-14EE-494C-AF3E-D5A7BA640B39", "versionEndExcluding": "6.6.135", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "02904CAE-71D2-45B3-9EC3-F6A9D18B6307", "versionEndExcluding": "6.12.82", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F", "versionEndExcluding": "6.18.23", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1490EF9B-9080-481C-8D22-1306AAE664E4", "versionEndExcluding": "6.19.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.22:-:*:*:*:*:*:*", "matchCriteriaId": "7F7D6C66-3384-4ACC-9D08-C5A26B4FD004", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix reference count leak in rxrpc_server_keyring()\n\nThis patch fixes a reference count leak in rxrpc_server_keyring()\nby checking if rx->securities is already set."}], "id": "CVE-2026-31634", "lastModified": "2026-04-27T20:30:25.177", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-24T15:16:42.707", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/12de9e0e0b0b7058be7dfb8a5927eb565bc25780"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/139c750bf06649097d98b0bc41e2a678b4627e27"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8ee931c3cd97f1c42b4fbf057f04b9dae45dfb7a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9ce36d28f67c2a477a7e2f03480de3f6783fb363"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c6d9ea26cf8756ad6f162578e94a5f82f6fae3c2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f125846ee79fcae537a964ce66494e96fa54a6de"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fc76d0bd00850b7372f0a4a319c0c60f80487632"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rxrpc: fix reference count leak in rxrpc_server_keyring()", "id": "2461483", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461483"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's rxrpc subsystem. An issue with managing reference counts in the `rxrpc_server_keyring()` function could lead to a resource leak. This vulnerability might allow a local attacker to exhaust system resources, potentially causing a denial of service (DoS)."], "name": "CVE-2026-31634", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31634\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31634\nhttps://lore.kernel.org/linux-cve-announce/2026042454-CVE-2026-31634-35fc@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[17926a79320afa9b95df6b977b40cca6d8713cea,fc76d0bd00850b7372f0a4a319c0c60f80487632)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[17926a79320afa9b95df6b977b40cca6d8713cea,c6d9ea26cf8756ad6f162578e94a5f82f6fae3c2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[17926a79320afa9b95df6b977b40cca6d8713cea,9ce36d28f67c2a477a7e2f03480de3f6783fb363)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[17926a79320afa9b95df6b977b40cca6d8713cea,12de9e0e0b0b7058be7dfb8a5927eb565bc25780)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[17926a79320afa9b95df6b977b40cca6d8713cea,8ee931c3cd97f1c42b4fbf057f04b9dae45dfb7a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[17926a79320afa9b95df6b977b40cca6d8713cea,139c750bf06649097d98b0bc41e2a678b4627e27)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[17926a79320afa9b95df6b977b40cca6d8713cea,f125846ee79fcae537a964ce66494e96fa54a6de)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.22"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.22)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.169,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.135,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.82,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.23,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.13,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T20:06:59.978635+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that contains the commit fixing the reference count leak in rxrpc_server_keyring()", "Reboot the system into the patched kernel to activate the fix and ensure the kernel image is using the updated code", "If RxRPC services are not required, disable the RxRPC module or block its associated ports to prevent its use"], "summary": {"action": "Patch", "impact": "Denial of Service via reference count leak in the Linux kernel RxRPC server keyring"}, "threat_synthesis": {"affected_systems": "All Linux kernel releases are flagged as affected by the change. The Common Platform Enumeration list includes the generic Linux kernel as well as specific versions such as 2.6.22 and the 7.0 release candidate series (rc1\u2011rc7). The patch applies to every build of the kernel that incorporates the commit referenced in the advisory, so any system running a pre\u2011patch kernel in those families is potentially impacted.", "description_and_impact": "The vulnerability resides in the Linux kernel\u2019s RxRPC server keyring implementation and manifests as a reference count leak that occurs when the function does not verify whether the security context has already been set. The unchecked increment allows the kernel to retain an extra reference to the keyring object indefinitely, which over time can exhaust system resources or lead to memory corruption. This weakness corresponds to a moderate severity (CVSS 5.5) and is classified under CWE\u2011911 (Unchecked Error Condition). The primary consequence is a denial\u2011of\u2011service condition that may be triggered by local privileged processes that use RxRPC services.", "risk_and_exploitability": "With a CVSS score of 5.5 the vulnerability poses a moderate threat. The EPSS score is less than 1%, indicating a low exploitation probability at present, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability would likely be exploited by a local user or process with sufficient privileges to interact with RxRPC services, triggering the leak. Remote exploitation appears unlikely because RxRPC interactions occur within the kernel\u2019s internal networking stack rather than over a network socket that accepts arbitrary input. The risk therefore hinges on local users or privileged processes that have access to the affected services."}}}}, "created": "2026-04-27T18:45:11.324183+00:00", "updated": "2026-04-28T20:15:26.810475+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}