Kernel Vulnerability in Linux Affecting RxRPC Client Call Management

CVE-2026-31638

What is CVE-2026-31638?

A vulnerability exists in the Linux kernel related to the RxRPC protocol that can result in unexpected kernel crashes. Specifically, the function rxrpc_input_packet_on_conn() does not properly manage references to client calls after the connection has been torn down. When the channel's call reference is NULL, the system fails to handle the error correctly, leading to a crash instead of appropriately rejecting the packet. This vulnerability highlights a flaw in reference count management, where the call reference is dropped unconditionally, even when it has not been acquired, potentially causing stability issues in the kernel during packet processing.

References