CVE-2026-31634

Vulnerability

CVE-2026-31634 describes a reference count leak in the rxrpc_server_keyring() function of the Linux kernel's RxRPC network protocol implementation. The function did not properly check if rx->securities was already initialized before setting it, leading to an increment of the reference count without a corresponding decrement under certain conditions.

Exploitation

An attacker would need to trigger the vulnerable code path to cause the reference count to be incremented multiple times. This could be achieved by repeatedly calling keyring-related operations that invoke rxrpc_server_keyring(). The vulnerability is local, requiring the ability to execute code or influence keyring operations on the system.

Impact

A reference count leak can eventually lead to resource exhaustion of kernel objects, potentially causing memory pressure or system instability. If the leak is severe, it might allow a local attacker to perform a denial-of-service (DoS) attack by exhausting memory. The CVSS score of 5.5 (Medium) reflects the local attack vector and confidentiality impact.

Mitigation

The Linux kernel community has addressed this issue by adding a check to ensure rx->securities is not already set before assigning it [1]. The fix has been backported to multiple stable kernels as indicated by the commit references [1][2][3][4]. Users are advised to update their kernels to include the patch.