CVE-2026-31642

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31642", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.127Z", "datePublished": "2026-04-24T14:44:56.888Z", "dateUpdated": "2026-11-06T15:32:21.029Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-01T16:13:09.070Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix call removal to use RCU safe deletion\n\nFix rxrpc call removal from the rxnet->calls list to use list_del_rcu()\nrather than list_del_init() to prevent stuffing up reading\n/proc/net/rxrpc/calls from potentially getting into an infinite loop.\n\nThis, however, means that list_empty() no longer works on an entry that's\nbeen deleted from the list, making it harder to detect prior deletion. Fix\nthis by:\n\nFirstly, make rxrpc_destroy_all_calls() only dump the first ten calls that\nare unexpectedly still on the list. Limiting the number of steps means\nthere's no need to call cond_resched() or to remove calls from the list\nhere, thereby eliminating the need for rxrpc_put_call() to check for that.\n\nrxrpc_put_call() can then be fixed to unconditionally delete the call from\nthe list as it is the only place that the deletion occurs."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/call_object.c"], "versions": [{"version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "3e47a38e584b905359fe0ce5be5165d1e8592a90", "status": "affected", "versionType": "git"}, {"version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "b15b1ce96777b88989a6a4de8d01efbcd81ad2d7", "status": "affected", "versionType": "git"}, {"version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "280efb85e9759881a9d31d0874baa04583cb6c09", "status": "affected", "versionType": "git"}, {"version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "93fc15be44a35b8e3c58d0238ac0d9b7c53465ff", "status": "affected", "versionType": "git"}, {"version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "c63abf25203b50243fe228090526f9dbf37727bd", "status": "affected", "versionType": "git"}, {"version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "3be718f659683ad89fad6f1eb66bee99727cae64", "status": "affected", "versionType": "git"}, {"version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "ac5f54691be06a32246179d41be2d73598036deb", "status": "affected", "versionType": "git"}, {"version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "146d4ab94cf129ee06cd467cb5c71368a6b5bad6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/call_object.c"], "versions": [{"version": "4.13", "status": "affected"}, {"version": "0", "lessThan": "4.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.135", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.82", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.23", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.13", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.6.135"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.12.82"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.18.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.19.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3e47a38e584b905359fe0ce5be5165d1e8592a90"}, {"url": "https://git.kernel.org/stable/c/b15b1ce96777b88989a6a4de8d01efbcd81ad2d7"}, {"url": "https://git.kernel.org/stable/c/280efb85e9759881a9d31d0874baa04583cb6c09"}, {"url": "https://git.kernel.org/stable/c/93fc15be44a35b8e3c58d0238ac0d9b7c53465ff"}, {"url": "https://git.kernel.org/stable/c/c63abf25203b50243fe228090526f9dbf37727bd"}, {"url": "https://git.kernel.org/stable/c/3be718f659683ad89fad6f1eb66bee99727cae64"}, {"url": "https://git.kernel.org/stable/c/ac5f54691be06a32246179d41be2d73598036deb"}, {"url": "https://git.kernel.org/stable/c/146d4ab94cf129ee06cd467cb5c71368a6b5bad6"}], "title": "rxrpc: Fix call removal to use RCU safe deletion", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:26.893Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31642", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:23:22.714337Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:32:21.029Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:26.893Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31642", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:23:22.714337Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:23:23.693Z"}}], "cna": {"title": "rxrpc: Fix call removal to use RCU safe deletion", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "3e47a38e584b905359fe0ce5be5165d1e8592a90", "versionType": "git"}, {"status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "b15b1ce96777b88989a6a4de8d01efbcd81ad2d7", "versionType": "git"}, {"status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "280efb85e9759881a9d31d0874baa04583cb6c09", "versionType": "git"}, {"status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "93fc15be44a35b8e3c58d0238ac0d9b7c53465ff", "versionType": "git"}, {"status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "c63abf25203b50243fe228090526f9dbf37727bd", "versionType": "git"}, {"status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "3be718f659683ad89fad6f1eb66bee99727cae64", "versionType": "git"}, {"status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "ac5f54691be06a32246179d41be2d73598036deb", "versionType": "git"}, {"status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "lessThan": "146d4ab94cf129ee06cd467cb5c71368a6b5bad6", "versionType": "git"}], "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/call_object.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.13"}, {"status": "unaffected", "version": "0", "lessThan": "4.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.135", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.82", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.23", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.13", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/call_object.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3e47a38e584b905359fe0ce5be5165d1e8592a90"}, {"url": "https://git.kernel.org/stable/c/b15b1ce96777b88989a6a4de8d01efbcd81ad2d7"}, {"url": "https://git.kernel.org/stable/c/280efb85e9759881a9d31d0874baa04583cb6c09"}, {"url": "https://git.kernel.org/stable/c/93fc15be44a35b8e3c58d0238ac0d9b7c53465ff"}, {"url": "https://git.kernel.org/stable/c/c63abf25203b50243fe228090526f9dbf37727bd"}, {"url": "https://git.kernel.org/stable/c/3be718f659683ad89fad6f1eb66bee99727cae64"}, {"url": "https://git.kernel.org/stable/c/ac5f54691be06a32246179d41be2d73598036deb"}, {"url": "https://git.kernel.org/stable/c/146d4ab94cf129ee06cd467cb5c71368a6b5bad6"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix call removal to use RCU safe deletion\n\nFix rxrpc call removal from the rxnet->calls list to use list_del_rcu()\nrather than list_del_init() to prevent stuffing up reading\n/proc/net/rxrpc/calls from potentially getting into an infinite loop.\n\nThis, however, means that list_empty() no longer works on an entry that's\nbeen deleted from the list, making it harder to detect prior deletion. Fix\nthis by:\n\nFirstly, make rxrpc_destroy_all_calls() only dump the first ten calls that\nare unexpectedly still on the list. Limiting the number of steps means\nthere's no need to call cond_resched() or to remove calls from the list\nhere, thereby eliminating the need for rxrpc_put_call() to check for that.\n\nrxrpc_put_call() can then be fixed to unconditionally delete the call from\nthe list as it is the only place that the deletion occurs."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.135", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.82", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.23", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.13", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "4.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-01T16:13:09.070Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31642", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:32:21.029Z", "dateReserved": "2026-03-09T15:48:24.127Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-24T14:44:56.888Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/call_object.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3e47a38e584b905359fe0ce5be5165d1e8592a90", "status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "versionType": "git"}, {"lessThan": "b15b1ce96777b88989a6a4de8d01efbcd81ad2d7", "status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "versionType": "git"}, {"lessThan": "280efb85e9759881a9d31d0874baa04583cb6c09", "status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "versionType": "git"}, {"lessThan": "93fc15be44a35b8e3c58d0238ac0d9b7c53465ff", "status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "versionType": "git"}, {"lessThan": "c63abf25203b50243fe228090526f9dbf37727bd", "status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "versionType": "git"}, {"lessThan": "3be718f659683ad89fad6f1eb66bee99727cae64", "status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "versionType": "git"}, {"lessThan": "ac5f54691be06a32246179d41be2d73598036deb", "status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "versionType": "git"}, {"lessThan": "146d4ab94cf129ee06cd467cb5c71368a6b5bad6", "status": "affected", "version": "2baec2c3f854d1f79c7bb28386484e144e864a14", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/call_object.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.13"}, {"lessThan": "4.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.135", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.82", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.23", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "36F24990-3D13-46FD-890A-DD2DC4FCEF1C", "versionEndExcluding": "6.6.135", "versionStartIncluding": "4.13.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "02904CAE-71D2-45B3-9EC3-F6A9D18B6307", "versionEndExcluding": "6.12.82", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F", "versionEndExcluding": "6.18.23", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1490EF9B-9080-481C-8D22-1306AAE664E4", "versionEndExcluding": "6.19.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.13:-:*:*:*:*:*:*", "matchCriteriaId": "40253A59-8422-42B7-B45F-FF9C4A824F3E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix call removal to use RCU safe deletion\n\nFix rxrpc call removal from the rxnet->calls list to use list_del_rcu()\nrather than list_del_init() to prevent stuffing up reading\n/proc/net/rxrpc/calls from potentially getting into an infinite loop.\n\nThis, however, means that list_empty() no longer works on an entry that's\nbeen deleted from the list, making it harder to detect prior deletion. Fix\nthis by:\n\nFirstly, make rxrpc_destroy_all_calls() only dump the first ten calls that\nare unexpectedly still on the list. Limiting the number of steps means\nthere's no need to call cond_resched() or to remove calls from the list\nhere, thereby eliminating the need for rxrpc_put_call() to check for that.\n\nrxrpc_put_call() can then be fixed to unconditionally delete the call from\nthe list as it is the only place that the deletion occurs."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: Correcci\u00f3n de la eliminaci\u00f3n de llamadas para usar la eliminaci\u00f3n segura de RCU\n\nCorrige la eliminaci\u00f3n de llamadas rxrpc de la lista rxnet -> calls para usar list_del_rcu() en lugar de list_del_init() para evitar que la lectura de /proc/ net/rxrpc/calls se atasque y potencialmente entre en un bucle infinito.\n\nEsto, sin embargo, significa que list_empty() ya no funciona en una entrada que ha sido eliminada de la lista, lo que dificulta la detecci\u00f3n de una eliminaci\u00f3n previa. Soluciona esto mediante:\n\nEn primer lugar, haz que rxrpc_destroy_all_calls() solo vuelque las primeras diez llamadas que inesperadamente a\u00fan est\u00e1n en la lista. Limitar el n\u00famero de pasos significa que no es necesario llamar a cond_resched() o eliminar llamadas de la lista aqu\u00ed, eliminando as\u00ed la necesidad de que rxrpc_put_call() lo compruebe.\n\nrxrpc_put_call() puede entonces ser corregido para eliminar incondicionalmente la llamada de la lista, ya que es el \u00fanico lugar donde ocurre la eliminaci\u00f3n."}], "id": "CVE-2026-31642", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31642", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:23:22.714337Z", "version": "2.0.3"}}]}, "published": "2026-04-24T15:16:43.567", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/146d4ab94cf129ee06cd467cb5c71368a6b5bad6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/280efb85e9759881a9d31d0874baa04583cb6c09"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3be718f659683ad89fad6f1eb66bee99727cae64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3e47a38e584b905359fe0ce5be5165d1e8592a90"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/93fc15be44a35b8e3c58d0238ac0d9b7c53465ff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ac5f54691be06a32246179d41be2d73598036deb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b15b1ce96777b88989a6a4de8d01efbcd81ad2d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c63abf25203b50243fe228090526f9dbf37727bd"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rxrpc: Fix call removal to use RCU safe deletion", "id": "2461572", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461572"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-821", "details": ["A flaw was found in the Linux kernel's rxrpc module. This vulnerability occurs due to incorrect handling of call removal, specifically using list_del_init() instead of list_del_rcu(). A local user reading the /proc/net/rxrpc/calls file could potentially trigger an infinite loop, leading to a Denial of Service (DoS) condition."], "name": "CVE-2026-31642", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31642\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31642\nhttps://lore.kernel.org/linux-cve-announce/2026042457-CVE-2026-31642-b2f3@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2baec2c3f854d1f79c7bb28386484e144e864a14,93fc15be44a35b8e3c58d0238ac0d9b7c53465ff)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2baec2c3f854d1f79c7bb28386484e144e864a14,c63abf25203b50243fe228090526f9dbf37727bd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2baec2c3f854d1f79c7bb28386484e144e864a14,3be718f659683ad89fad6f1eb66bee99727cae64)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2baec2c3f854d1f79c7bb28386484e144e864a14,ac5f54691be06a32246179d41be2d73598036deb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2baec2c3f854d1f79c7bb28386484e144e864a14,146d4ab94cf129ee06cd467cb5c71368a6b5bad6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.135,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.82,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.23,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.13,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T23:36:21.964164+00:00", "value": {"mitigation_remediation": ["Upgrade to a Linux kernel release that includes the rxrpc call removal patch (commit 146d4ab94cf129ee06cd467cb5c71368a6b5bad6).", "If an immediate kernel upgrade is not possible, disable the rxrpc service or restrict access to the /proc/net/rxrpc/calls interface to prevent the infinite loop from being triggered.", "Monitor system CPU usage for anomalous spikes when accessing /proc/net/rxrpc/calls and reboot the system if a hang or high CPU is observed."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Affected installations include Linux kernel 4.13 and all 7.0 release\u2011candidate builds (rc1 through rc7) as indicated by the CPE enumeration. Any system running these kernel releases without the patch is at risk.", "description_and_impact": "The Linux kernel\u2019s rxrpc subsystem uses list_del_rcu() to remove a call from the internal list but fails to account for RCU\u2011safe deletion, causing an infinite loop when users read the /proc/net/rxrpc/calls interface. The infinite loop can consume excessive CPU resources, potentially disrupting system availability. This flaw is represented by CWE\u2011835 (Infinite Loop) and may also lead to a deadlock scenario, CWE\u2011821.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The serious impact is limited to service availability; confidentiality or integrity are not affected. Likely exploitation requires local access that can trigger the call removal, such as a process that can read the /proc/net/rxrpc/calls interface, or a local user that can otherwise force the removal of rxrpc calls. The vulnerability is not listed in CISA\u2019s KEV catalog."}}}}, "created": "2026-04-27T18:45:11.320076+00:00", "updated": "2026-04-28T23:45:16.051849+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}