PT-2026-34994 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-06-02 · CVE-2026-31642

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the rxrpc component where call removal from the rxnet->calls list used list del init() instead of list del rcu(). This could lead to an infinite loop when reading '/proc/net/rxrpc/calls'. The fix involves implementing RCU (Read-Copy Update) safe deletion, which is a synchronization mechanism that allows multiple readers to access data while it is being updated. Additionally, the rxrpc destroy all calls() function was modified to limit the number of dumped calls to prevent excessive processing, and rxrpc put call() was updated to handle call deletion unconditionally.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-31642

ECHO-6096-8E00-66F4

Affected Products

Linux Kernel

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2026-31642 · Security Note
• https://git.kernel.org/stable/c/ac5f54691be06a32246179d41be2d73598036deb · Patch
• https://cve.org/CVERecord?id=CVE-2026-31642 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31642 · Vendor Advisory
• https://git.kernel.org/stable/c/93fc15be44a35b8e3c58d0238ac0d9b7c53465ff · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31642 · Vendor Advisory
• https://git.kernel.org/stable/c/3be718f659683ad89fad6f1eb66bee99727cae64 · Patch
• https://git.kernel.org/stable/c/c63abf25203b50243fe228090526f9dbf37727bd · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31642 · Vendor Advisory
• https://git.kernel.org/stable/c/146d4ab94cf129ee06cd467cb5c71368a6b5bad6 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31642 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31642 · Vendor Advisory
• https://reddit.com/r/slackware/comments/1tupi6s/fyi_slackware_150_changelog_includes_kernel · Reddit Post
• https://twitter.com/CVEnew/status/2047731941038829700 · Twitter Post
• https://git.kernel.org/stable/c/3e47a38e584b905359fe0ce5be5165d1e8592a90 · Note