CVE-2026-31670: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31670 is a memory exhaustion vulnerability in the Linux kernel's rfkill subsystem, classified as a denial-of-service (DoS) flaw. The root cause is the absence of any limit on the number of pending rfkill events that userspace can create without consuming them from the rfkill file descriptor. It affects Linux kernel versions from 2.6.31 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0. The vulnerability was published on April 24, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The rfkill subsystem in the Linux kernel allows userspace processes to generate rfkill events (used to manage wireless radio kill switches) via a file descriptor interface; however, no upper bound was enforced on the number of events that could be queued. A local, low-privileged attacker can exploit this by continuously generating rfkill events without reading (consuming) them from the file descriptor, causing the kernel to allocate memory indefinitely until the system runs out of memory. The fix bounds the number of pending rfkill events at 1,000 to prevent this abuse (GitHub Advisory, Kernel Patch).

Successful exploitation results in a denial-of-service condition through memory exhaustion, affecting system availability with no impact on confidentiality or integrity. A low-privileged local attacker can deplete system memory resources, potentially causing kernel OOM (out-of-memory) kills, system instability, or complete system unavailability. The impact is confined to the local system and does not directly enable lateral movement or data exfiltration (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of writing (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, which further limits the practical attack surface.

• System Logs: Kernel OOM killer messages in /var/log/kern.log or dmesg output indicating memory exhaustion events; messages referencing rfkill subsystem activity.
• Process Behavior: Unusual processes repeatedly opening or writing to /dev/rfkill without reading from it; high memory consumption by a low-privileged process interacting with the rfkill interface.
• File System: Unexpected or repeated access to /dev/rfkill by non-administrative users visible in audit logs (auditd).
• Memory: Rapid, sustained increase in kernel memory usage (/proc/meminfo showing declining MemFree/MemAvailable) without a corresponding increase in user-space application memory.

Apply the appropriate patched Linux kernel version for your branch: 5.10.253 (for 2.6.31.1–5.10.x), 5.15.203 (for 5.11–5.15.x), 6.1.169 (for 5.16–6.1.x), 6.6.135 (for 6.2–6.6.x), 6.12.82 (for 6.7–6.12.x), 6.18.23 (for 6.13–6.18.x), 6.19.13 (for 6.19.x), or 7.0 and later (GitHub Advisory, Red Hat Bugzilla). As a temporary workaround prior to patching, restrict local system access to trusted users only and monitor for unusual memory consumption patterns related to rfkill activity. Amazon Linux 2 users can refer to the ALAS advisory for kernel 5.10 (AWS ALAS).