Linux Kernel Vulnerability in RXRPC for Service Connections

CVE-2026-31676

What is CVE-2026-31676?

A vulnerability in the Linux kernel affects the RXRPC subsystem, where RESPONSE packets are improperly handled during the service challenge phase. The issue arises because the current implementation allows duplicate or delayed RESPONSE packets to incorrectly re-trigger the setup sequence after the service state has transitioned, leading to potential security risks. The vulnerability has been addressed by ensuring that only RESPONSE packets are processed while the connection is still in the RXRPC_CONN_SERVICE_CHALLENGING state, enforcing stricter state checks and secure flag usage to manage response verification and connection work securely.

References