NULL pointer dereference in Linux kernel - CVE-2026-31638
Published: April 25, 2026
Vulnerability identifier: #VU127752
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-31638
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of a NULL pointer reference in rxrpc_input_packet_on_conn() when processing a to-client packet after the current client call on the channel has already been torn down. A remote attacker can send a crafted packet to cause a denial of service.
The issue occurs on the client-side implicit-end error path when chan->call is NULL and no call reference was acquired.
How to mitigate CVE-2026-31638
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/0c156aff8a2d4fa0d61db7837641975cf0e5452d
- https://git.kernel.org/stable/c/6331f1b24a3e85465f6454e003a3e6c22005a5c5
- https://git.kernel.org/stable/c/8299ca146489664e3c0c90a3b8900d8335b1ede4
- https://git.kernel.org/stable/c/9fb09861e2b8d1abfe2efaf260c9f1d30080ea38
- https://git.kernel.org/stable/c/b8f66447448d6c305a51413a67ec8ed26aa7d1dd