CVE-2026-31676 rxrpc: only handle RESPONSE during service challenge
A race condition in the Linux kernel's rxrpc module allows duplicate RESPONSE packets to bypass security checks during service challenge.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31676?
CVE-2026-31676 is a high-severity vulnerability in Linux kernel, published on 25 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: only handle RESPONSE during service challenge
Only process RESPONSE packets while the service connection is still in RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before running response verification and security initialization, then use a local secured flag to decide whether to queue the secured-connection work after the state transition. This keeps duplicate or late RESPONSE packets from re-running the setup path and removes the unlocked post-transition state test.
Weakness: CWE-362
Which versions are affected by CVE-2026-31676?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31676?
Apply the vendor's patch.
Is CVE-2026-31676 being exploited?
There is no known exploitation of CVE-2026-31676 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-84207, BELL-CVE-2026-31676, DEBIAN-CVE-2026-31676, GHSA-cpfq-5p4h-49pp, ROOT-OS-DEBIAN-11-CVE-2026-31676, ROOT-OS-DEBIAN-12-CVE-2026-31676 and 3 more.