CVE-2026-31634: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31634 is a reference count leak vulnerability in the Linux kernel's rxrpc_server_keyring() function within the rxrpc (RX Remote Procedure Call) subsystem. The flaw exists because the function does not check whether rx->securities is already set before assigning it, causing improper reference count management and kernel memory leaks. It affects Linux kernel versions from 2.6.22 through numerous stable branches, with fixed versions available across multiple LTS lines. The vulnerability was published on April 24, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-911 (Improper Update of Reference Count). In rxrpc_server_keyring(), the code fails to verify whether rx->securities has already been populated before setting it, resulting in the previous reference not being released — a classic reference count leak pattern. Exploitation requires local access with low privileges, as an attacker must be able to invoke the affected code path repeatedly to accumulate leaked references and exhaust kernel memory. No public proof-of-concept or detailed technical write-up beyond the kernel commit description is currently available (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation leads to a denial-of-service condition through progressive kernel memory exhaustion. A local attacker with low privileges can repeatedly trigger the reference count leak, eventually depleting kernel memory resources and causing system instability or a crash. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (CVSS A:H, C:N, I:N) (GitHub Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, which further limits the practical attack surface.

Apply the appropriate patched Linux kernel version for your branch: 5.15.203 or later, 6.1.169 or later, 6.6.135 or later, 6.12.82 or later, 6.18.23 or later, or 6.19.13 or later. Patch commits are available at git.kernel.org for integration into custom kernel builds (GitHub Advisory). As a compensating control, restrict local user access to affected systems to reduce the attack surface, since exploitation requires local low-privilege access. Amazon Linux users should apply the ALAS2KERNEL-5.15-2026-102 update where applicable.