CVE-2026-31676
Published: 25 April 2026
Summary
CVE-2026-31676 is a high-severity an unspecified weakness vulnerability in Linux Linux Kernel. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 30.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2026-31676 is a vulnerability in the Linux kernel's RxRPC implementation. It stems from improper handling of RESPONSE packets during the service connection challenging phase, where packets were processed even after the connection transitioned out of the RXRPC_CONN_SERVICE_CHALLENGING state. This allowed duplicate or late RESPONSE packets to re-run the response verification, security initialization, and secured-connection setup path without proper state locking, potentially leading to resource exhaustion or disruption.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation results in a denial-of-service condition due to high availability impact, as indicated by the CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity impacts.
Mitigation requires updating to a patched Linux kernel version that includes the upstream fixes. The referenced stable kernel commits address the issue by enforcing state checks under state_lock before processing RESPONSE packets and using a local secured flag to control post-transition queuing: https://git.kernel.org/stable/c/03fd2ef73cb4ffd0af100a95b634af54f474414e, https://git.kernel.org/stable/c/29b44d904dceb832be880def08b8cb17a0aba91c, https://git.kernel.org/stable/c/a6bcf8010af093fe04f7100562e9542ab7882585, https://git.kernel.org/stable/c/c43ffdcfdbb5567b1f143556df8a04b4eeea041c, and https://git.kernel.org/stable/c/d0035e634dae83237ab7f5681eb52b2f65d0ceb8.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25643
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challenge Only process RESPONSE packets while the service connection is still in RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before running response verification and security…
more
initialization, then use a local secured flag to decide whether to queue the secured-connection work after the state transition. This keeps duplicate or late RESPONSE packets from re-running the setup path and removes the unlocked post-transition state test.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remotely exploitable flaw in Linux kernel RxRPC packet handling that directly enables an unauthenticated network attacker to trigger resource exhaustion and a denial-of-service condition (high availability impact, no confidentiality/integrity impact). This precisely matches T1499.004 (Application or System Exploitation) under Endpoint Denial of Service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of the specific Linux kernel flaw in RxRPC packet handling via patching to prevent exploitation.
Provides denial-of-service protections tailored to limit effects of resource exhaustion from duplicate or late RESPONSE packets in RxRPC.
Enforces protections against resource exhaustion conditions caused by re-running unsecured RxRPC setup paths without proper state checks.