PT-2026-34990 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-04-28 · CVE-2026-31638

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A reference count error exists in the rxrpc component. The function rxrpc input packet on conn() may process a to-client packet after the current client call on the channel has been torn down, resulting in chan->call being NULL and rxrpc try get call() returning NULL. The client-side implicit-end error path fails to account for this and unconditionally calls rxrpc put call(), which can lead to a kernel crash instead of simply rejecting the packet.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-31638

Affected Products

Linux Kernel

References · 16

• https://ubuntu.com/security/CVE-2026-31638 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31638 · Vendor Advisory
• https://git.kernel.org/stable/c/0c156aff8a2d4fa0d61db7837641975cf0e5452d · Patch
• https://git.kernel.org/stable/c/8299ca146489664e3c0c90a3b8900d8335b1ede4 · Patch
• https://git.kernel.org/stable/c/9fb09861e2b8d1abfe2efaf260c9f1d30080ea38 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31638 · Vendor Advisory
• https://git.kernel.org/stable/c/b8f66447448d6c305a51413a67ec8ed26aa7d1dd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31638 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31638 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31638 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-31638 · Vendor Advisory
• https://git.kernel.org/stable/c/6331f1b24a3e85465f6454e003a3e6c22005a5c5 · Patch
• https://twitter.com/VulmonFeeds/status/2047792780798263780 · Twitter Post
• https://docs.bell-sw.com/security/cves/CVE-2026-31638 · Note
• https://git.kernel.org/linus/6331f1b24a3e85465f6454e003a3e6c22005a5c5 · Note