CVE-2026-31670

Vulnerability

Details

The Linux kernel's rfkill subsystem allows userspace to create an unlimited number of rfkill events when the system is configured appropriately. If userspace does not consume these events from the rfkill file descriptor, the kernel can accumulate an unbounded number of pending events, potentially leading to an out-of-memory (OOM) condition. The fix introduces a limit of 1000 pending events to prevent abuse [1].

Exploitation

An attacker with local access and the ability to generate rfkill events (e.g., through /dev/rfkill or netlink) can exploit this by rapidly creating events without reading them. The attack requires no special privileges beyond the ability to interact with the rfkill interface, depending on system configuration. The vulnerability is triggered purely by event generation and lack of consumption.

Impact

Successful exploitation can exhaust system memory, leading to denial of service (DoS) through system instability or crash. The CVSS v3 score of 5.5 (Medium) reflects the local attack vector and availability impact.

Mitigation

The fix has been applied in the Linux kernel stable tree, bounding pending rfkill events to 1000 [1]. Users should update to a kernel version that includes this commit. No workaround is documented.