CVE-2026-31640: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31640 is a logic error vulnerability in the Linux kernel's RxRPC protocol implementation, specifically in the rxrpc_post_response() function, where an incorrect socket buffer (skb) is referenced when comparing queued RESP challenge serial numbers. This flaw causes the comparison to always evaluate as false, preventing proper validation of response packets and potentially enabling packet injection, replay attacks, or denial of service. Affected Linux kernel versions include 6.16.1 through 6.18.22 and 6.19 through 6.19.12, as well as release candidates for 7.0 up to rc7. The vulnerability was published on April 24, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-1025 (Comparison Using Wrong Factors) and CWE-401 (Missing Release of Memory after Effective Lifetime). In rxrpc_post_response(), the code incorrectly references the newer packet's private data instead of the cached (older) response packet when comparing challenge serial numbers, causing the conditional check to always return false. This means the kernel never properly decides whether to replace a queued response with a newer one, and also fails to release whichever packet is not used — resulting in a memory leak alongside the logic error. The fix involves switching the comparison to use the older (cached) packet's data, substituting the new packet only when it is actually newer, and releasing the unused packet (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation of this vulnerability could allow a network-adjacent or remote attacker to bypass RxRPC response packet validation, enabling packet injection or replay attacks against services relying on the RxRPC protocol. The availability impact is rated High, meaning an attacker could cause denial of service conditions on affected systems. There is no confidentiality or integrity impact identified, and lateral movement potential is limited to disruption of RxRPC-dependent services (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.054% per GitHub Advisory), placing it in the 17th percentile for exploitation likelihood within 30 days (GitHub Advisory). No threat actor attribution has been reported.

Patches are available in the Linux kernel stable trees. Administrators should upgrade to kernel version 6.18.23 or later (for the 6.18.x branch), 6.19.13 or later (for the 6.19.x branch), or the 7.0 release or later. The specific fixes are available at the following upstream commits: 20386e7f, 9132b1a7, and b33f5741. Systems not using RxRPC (e.g., those not running AFS or similar services) may have reduced exposure, but patching remains the recommended remediation (GitHub Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via their Bugzilla system with a medium priority/severity rating, and the upstream kernel community addressed it promptly through the stable tree patch process (Red Hat Bugzilla). No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability tracking.