CVE-2026-31643

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31643", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.127Z", "datePublished": "2026-04-24T14:44:57.540Z", "dateUpdated": "2026-05-11T22:12:46.954Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:12:46.954Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix key parsing memleak\n\nIn rxrpc_preparse_xdr_yfs_rxgk(), the memory attached to token->rxgk can be\nleaked in a few error paths after it's allocated.\n\nFix this by freeing it in the \"reject_token:\" case."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/key.c"], "versions": [{"version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6", "lessThan": "d5f76f812d2c0ea6dd651b0586be49e85ecca085", "status": "affected", "versionType": "git"}, {"version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6", "lessThan": "01f51318feb626deee1d0c8a190198cd7857d599", "status": "affected", "versionType": "git"}, {"version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6", "lessThan": "b555912b9b21075e8298015f888ffe3ff60b1a97", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/key.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.23", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.13", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d5f76f812d2c0ea6dd651b0586be49e85ecca085"}, {"url": "https://git.kernel.org/stable/c/01f51318feb626deee1d0c8a190198cd7857d599"}, {"url": "https://git.kernel.org/stable/c/b555912b9b21075e8298015f888ffe3ff60b1a97"}], "title": "rxrpc: Fix key parsing memleak", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rxrpc/key.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d5f76f812d2c0ea6dd651b0586be49e85ecca085", "status": "affected", "version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6", "versionType": "git"}, {"lessThan": "01f51318feb626deee1d0c8a190198cd7857d599", "status": "affected", "version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6", "versionType": "git"}, {"lessThan": "b555912b9b21075e8298015f888ffe3ff60b1a97", "status": "affected", "version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rxrpc/key.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.23", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EAE31F43-AAC5-4801-B2B2-119D62A532A2", "versionEndExcluding": "6.18.23", "versionStartIncluding": "6.16.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1490EF9B-9080-481C-8D22-1306AAE664E4", "versionEndExcluding": "6.19.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*", "matchCriteriaId": "6238B17D-C12B-458F-A138-97039BFC4595", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix key parsing memleak\n\nIn rxrpc_preparse_xdr_yfs_rxgk(), the memory attached to token->rxgk can be\nleaked in a few error paths after it's allocated.\n\nFix this by freeing it in the \"reject_token:\" case."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: Soluci\u00f3n a la fuga de memoria en el an\u00e1lisis de claves\n\nEn rxrpc_preparse_xdr_yfs_rxgk(), la memoria adjunta a token -> rxgk puede fugarse en algunas rutas de error despu\u00e9s de ser asignada.\n\nEsto se soluciona liber\u00e1ndola en el caso \u2019reject_token:\u2019."}], "id": "CVE-2026-31643", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-24T15:16:43.673", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/01f51318feb626deee1d0c8a190198cd7857d599"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b555912b9b21075e8298015f888ffe3ff60b1a97"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d5f76f812d2c0ea6dd651b0586be49e85ecca085"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rxrpc: Fix key parsing memleak", "id": "2461547", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461547"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's rxrpc subsystem. During key parsing, a memory leak can occur in certain error paths. This vulnerability could allow a local or remote attacker to cause a denial of service by exhausting system memory."], "name": "CVE-2026-31643", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31643\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31643\nhttps://lore.kernel.org/linux-cve-announce/2026042457-CVE-2026-31643-54c3@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ca100ff4df64f5d0f6c1dd5080c3e096786bea6,d5f76f812d2c0ea6dd651b0586be49e85ecca085)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ca100ff4df64f5d0f6c1dd5080c3e096786bea6,01f51318feb626deee1d0c8a190198cd7857d599)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ca100ff4df64f5d0f6c1dd5080c3e096786bea6,b555912b9b21075e8298015f888ffe3ff60b1a97)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.23,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.13,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T13:50:41.834149+00:00", "value": {"mitigation_remediation": ["Upgrade the system to a Linux kernel version that includes the rxrpc key parsing memory leak fix.", "If an immediate kernel update is not feasible, disable the rxrpc protocol or restrict inbound traffic that can invoke it.", "Apply additional kernel hardening and monitor system memory usage for anomalous patterns associated with rxrpc."], "summary": {"action": "Apply Patch", "impact": "Memory Leak"}, "threat_synthesis": {"affected_systems": "The affected code is part of the Linux kernel. Versions 6.16 and all 7.0 release candidates up through 7.0 rc7 are vulnerable.", "description_and_impact": "The vulnerability resides in the Linux kernel\u2019s rxrpc protocol handler. An error in the key parsing routine can cause memory that was allocated for a token to be left referenced after an error path, resulting in a memory leak. The leaked memory may impact system stability or memory availability. The weakness is a classic memory management issue classified as CWE\u2011401 and CWE\u2011772.", "risk_and_exploitability": "The CVSS score of 5.5 places the flaw in the moderate range. The EPSS score indicates an exploitation probability of less than 1\u202f%. The vulnerability is not listed in CISA\u2019s KEV catalog. No public exploitation is documented in the CVE record. Based on the description, the likely attack vector would require the attacker to trigger error conditions in the rxrpc protocol, which suggests a local or network\u2011based vector that can manipulate rxrpc traffic. However, explicit exploitation requirements are not detailed in the available data, so the attack surface is inferred to be limited."}}}}, "created": "2026-04-27T18:45:11.319632+00:00", "updated": "2026-04-28T14:00:16.493314+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}