CVE-2026-31676

High

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challenge Only process RESPONSE packets while the service connection is still in RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before running response verification and security initialization, then use a local secured flag to decide whether to queue the secured-connection work after the state transition. This keeps duplicate or late RESPONSE packets from re-running the setup path and removes the unlocked post-transition state test.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Linux Kernel

PublishedApr 25, 2026

First seenApr 25, 2026

Weakness typeCWE-362Race condition

How to fix

Update

linux linux_kernel6.6.136, 6.12.84, 6.18.23, 6.19.13 or later

Affected products

Product	Affected versions	Fixed in
linux linux_kernel	2.6.22 ≤ v < 6.6.136, 6.7 ≤ v < 6.12.84, 6.13 ≤ v < 6.18.23, 6.19 ≤ v < 6.19.13, 7.0	6.6.136, 6.12.84, 6.18.23, 6.19.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.