CVE-2026-31639

In the Linux kernel's rxrpc subsystem, a reference count leak exists in rxrpc_alloc_client_call(). The function obtains a reference to the call's key but never releases it, leaving the key permanently referenced after the call is destroyed. This can be observed via /proc/keys where the key remains listed with an elevated reference count. [1]

To exploit this, an attacker would need the ability to create many client calls, continuously acquiring key references. No special privileges beyond normal user access are required if the system uses rxrpc client calls (e.g., for AFS). Each call leaks one reference, so repeated call creation can exhaust kernel key resources.

The primary impact is a denial of service due to resource exhaustion. The keyring may fill with stale, unreclaimable keys, preventing new key allocations and potentially affecting other subsystems that depend on key management.

Linux kernel stable branches have been patched via commits [1][2][3][4]. Users are advised to update to the latest kernel versions to close this leak.