CVE-2026-31642: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31642 is a denial-of-service vulnerability in the Linux kernel's rxrpc (Reliable Datagram Sockets over UDP) subsystem caused by improper RCU-safe list deletion. The flaw exists in the call removal process where list_del_init() was used instead of list_del_rcu() when removing entries from the rxnet->calls list, which can cause an infinite loop when reading /proc/net/rxrpc/calls. It affects Linux kernel versions 4.13.1 through 6.6.134, 6.7 through 6.12.81, 6.13 through 6.18.22, and 6.19 through 6.19.12. Disclosed on April 24, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-821 (Incorrect Synchronization) and CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). When a call is removed from the rxnet->calls list using list_del_init(), the list entry's pointers are set to point back to itself, which is not safe for concurrent RCU readers traversing the list — a reader iterating /proc/net/rxrpc/calls can get stuck in an infinite loop. The fix replaces list_del_init() with list_del_rcu() in rxrpc_put_call(), making it the sole deletion point, and limits rxrpc_destroy_all_calls() to dumping only the first ten unexpected remaining calls to avoid the need for cond_resched() or in-place removal. Exploitation requires local access with low privileges and no user interaction (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a denial-of-service condition affecting system availability. A local attacker with low privileges can trigger an infinite loop in the kernel by reading /proc/net/rxrpc/calls, potentially causing system hangs or resource exhaustion. There is no impact on confidentiality or data integrity, and the vulnerability's scope is limited to the local system without lateral movement potential (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term (GitHub Advisory, Red Hat Bugzilla).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing repeated or hung reads on /proc/net/rxrpc/calls; kernel warnings related to rxrpc call list traversal.
• Process: Processes stuck in uninterruptible sleep (D state) while reading /proc/net/rxrpc/calls; unexpectedly high CPU usage attributed to kernel threads in the rxrpc subsystem.
• System Behavior: System unresponsiveness or hangs coinciding with access to /proc/net/rxrpc/calls; elevated load average without corresponding user-space activity.

Apply kernel updates to reach the following patched versions depending on your branch: 6.6.135 or later, 6.12.82 or later, 6.18.23 or later, or 6.19.13 or later. Patches are available in the Linux kernel stable repositories. As a temporary workaround where patching is not immediately possible, restrict local user access to /proc/net/rxrpc/calls or limit access to the system for untrusted local users. Monitor for unexpected system hangs or high CPU usage as indicators of exploitation attempts (GitHub Advisory, Red Hat Bugzilla).

The vulnerability received routine coverage in Linux security update channels, including Slackware's security advisory (SSA-2026-152-01) and community discussion on Reddit's r/slackware regarding the kernel update. No notable researcher commentary or significant media coverage beyond standard Linux kernel security update reporting has been observed (Linux Compatible).