CVE-2026-31638

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-31638

Key Details

CVE	CVE-2026-31638
CVSS Score / Version	7.5 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is none; availability impact is high.
Affected products	Linux Kernel
Classified as	CWE-476 (NULL Pointer Dereference)

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Only put the call ref if one was acquired

rxrpc_input_packet_on_conn() can process a to-client packet after the

current client call on the channel has already been torn down. In that

case chan->call is NULL, rxrpc_try_get_call() returns NULL and there is

no reference to drop.

The client-side implicit-end error path does not account for that and

unconditionally calls rxrpc_put_call(). This turns a protocol error

path into a kernel crash instead of rejecting the packet.

Only drop the call reference if one was actually acquired. Keep the

existing protocol error handling unchanged. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-31638
CVE	https://www.cve.org/CVERecord?id=CVE-2026-31638

Source

Reference

NVD

CVE