Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system hang or denial of service. By reading specific network diagnostic information, an attacker can trigger an infinite loop within the kernel due to improper handling of internal data structures. This affects systems using the AF_RXRPC protocol, commonly used for certain distributed file systems and network communications.
Technical details
A vulnerability exists in the rxrpc protocol implementation within the Linux kernel due to the use of non-RCU safe deletion (list_del_init) on the rxnet->calls list. When a local user reads /proc/net/rxrpc/calls, the kernel iterates through this list; if a call is removed simultaneously using the unsafe method, the iterator can become corrupted, leading to an infinite loop (CWE-835). The fix replaces list_del_init() with list_del_rcu() in rxrpc_put_call() and refactors rxrpc_destroy_all_calls() to ensure safe iteration and prevent the hang. This is reachable by any local user with permissions to read the affected procfs entry.
Affected products
- Linux Linux Kernel 4.13.1 to 6.6.135, 6.7 to 6.12.82, 6.13 to 6.18.23, 6.19 to 6.19.13, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-08: patched: Initial patch authored by David Howells
- 2026-04-24: advisory: CVE-2026-31642 published
References
- https://git.kernel.org/stable/c/146d4ab94cf129ee06cd467cb5c71368a6b5bad6
- https://git.kernel.org/stable/c/280efb85e9759881a9d31d0874baa04583cb6c09
- https://git.kernel.org/stable/c/3be718f659683ad89fad6f1eb66bee99727cae64
- https://git.kernel.org/stable/c/3e47a38e584b905359fe0ce5be5165d1e8592a90
- https://git.kernel.org/stable/c/93fc15be44a35b8e3c58d0238ac0d9b7c53465ff
- https://git.kernel.org/stable/c/ac5f54691be06a32246179d41be2d73598036deb
- https://git.kernel.org/stable/c/b15b1ce96777b88989a6a4de8d01efbcd81ad2d7