CVE-2026-31676

Vulnerability

In the Linux kernel's AF_RXRPC protocol implementation, a flaw in service connection handling permits duplicate or late RESPONSE packets to re-run the security initialization path. The code previously did not check the connection state under the state_lock before processing RESPONSE packets, so packets arriving after the connection had transitioned out of the RXRPC_CONN_SERVICE_CHALLENGING state could still trigger response verification and security setup [1].

Exploitation

An attacker able to send crafted AF_RXRPC packets to a service endpoint could exploit this race condition. By sending multiple or timely RESPONSE packets, the security initialization routine could be executed multiple times, leading to repeated queuing of secured-connection work and potential state corruption [2].

Impact

Re-running the setup path may cause resource exhaustion, inconsistent connection state, or denial of service. The vulnerability is rated High (CVSS 7.5) by the vendor, indicating significant availability impact. While the description does not confirm privilege escalation, the re-initialization of security could bypass normal state transitions [3].

Mitigation

The fix adds a state check under state_lock and uses a local secured flag to prevent duplicate processing. The patch has been backported to multiple stable kernel releases via commits [1], [2], [3], and [4]. Users should update their kernels to include these fixes.