CVE Explorer

CVE-2026-31638

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Only put the call ref if one was acquired rxrpc_input_packet_on_conn() can process a to-client packet after the current client call on the channel has already been torn down. In that case chan->call is NULL, rxrpc_try_get_call() returns NULL and there is no reference to drop. The client-side implicit-end error path does not account for that and unconditionally calls rxrpc_put_call(). This turns a protocol error path

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:159d883b5b57047595905d09b746aa0ba01c256adc98d54a13220fa83f978427

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/io_thread.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrE…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:55688082ea576e2061d37d59201019594f2a6d5b550321caa33dc9f0138590a9 · sha256:f69c58ec0dbefa69… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/io_thread.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b8f66447448d6c305a51413a67ec8ed26aa7d1dd","status":"affected","version":"5e6ef4f1017c7f844e305283bbd8875af475e2fc","versionType":"git"},{"lessThan":"0c156aff8a2d4fa0d61db7837641975cf0e5452d","status":"affected","version":"5e6ef4f1017c7f844e305283bbd8875af475e2fc","versionType":"git"},{"lessThan":"8299ca146489664e3c0c90a3b8900d8335b1ede4","status":"affected","version":"5e6ef4f1017c7f844e305283…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:55688082ea576e2061d37d59201019594f2a6d5b550321caa33dc9f0138590a9 · sha256:f69c58ec0dbefa69… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:55688082ea576e2061d37d59201019594f2a6d5b550321caa33dc9f0138590a9 · sha256:f69c58ec0dbefa69… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:55688082ea576e2061d37d59201019594f2a6d5b550321caa33dc9f0138590a9 · sha256:f69c58ec0dbefa69… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:55688082ea576e2061d37d59201019594f2a6d5b550321caa33dc9f0138590a9 · sha256:f69c58ec0dbefa69… · /containers/cna/metrics/0/cvssV3_1

Source references

5 source assertions

{"url":"https://git.kernel.org/stable/c/0c156aff8a2d4fa0d61db7837641975cf0e5452d"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55688082ea576e2061d37d59201019594f2a6d5b550321caa33dc9f0138590a9 · sha256:f69c58ec0dbefa69… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/6331f1b24a3e85465f6454e003a3e6c22005a5c5"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55688082ea576e2061d37d59201019594f2a6d5b550321caa33dc9f0138590a9 · sha256:f69c58ec0dbefa69… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/8299ca146489664e3c0c90a3b8900d8335b1ede4"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55688082ea576e2061d37d59201019594f2a6d5b550321caa33dc9f0138590a9 · sha256:f69c58ec0dbefa69… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/9fb09861e2b8d1abfe2efaf260c9f1d30080ea38"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55688082ea576e2061d37d59201019594f2a6d5b550321caa33dc9f0138590a9 · sha256:f69c58ec0dbefa69… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/b8f66447448d6c305a51413a67ec8ed26aa7d1dd"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55688082ea576e2061d37d59201019594f2a6d5b550321caa33dc9f0138590a9 · sha256:f69c58ec0dbefa69… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer