Medium 5.5Published Apr 24, 2026

CVE-2026-31642rxrpc: Fix call removal to use RCU safe deletion

Updated under an hour ago (Oct 28, 2026, 3:50 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call removal to use RCU safe deletion Fix rxrpc call removal from the rxnet->calls list to use list_del_rcu() rather than list_del_init() to prevent stuffing up reading /proc/net/rxrpc/calls from potentially getting into an infinite loop. This, however, means that list_empty() no longer works on an entry that's been deleted from the list, making it harder to detect prior deletion. Fix this by: Firstly, make rxrpc_destroy_all_calls() only dump the first ten calls that are unexpectedly still on the list. Limiting the number of steps means there's no need to call cond_resched() or to remove calls from the list here, thereby eliminating the need for rxrpc_put_call() to check for that. rxrpc_put_call() can then be fixed to unconditionally delete the call from the list as it is the only place that the deletion occurs.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2baec2c3f854d1f79c7bb28386484e144e864a14 before 3e47a38e584b905359fe0ce5be5165d1e8592a90; from 2baec2c3f854d1f79c7bb28386484e144e864a14 before b15b1ce96777b88989a6a4de8d01efbcd81ad2d7; from 2baec2c3f854d1f79c7bb28386484e144e864a14 before 280efb85e9759881a9d31d0874baa04583cb6c09; from 2baec2c3f854d1f79c7bb28386484e144e864a14 before 93fc15be44a35b8e3c58d0238ac0d9b7c53465ff; from 2baec2c3f854d1f79c7bb28386484e144e864a14 before c63abf25203b50243fe228090526f9dbf37727bd; from 2baec2c3f854d1f79c7bb28386484e144e864a14 before 3be718f659683ad89fad6f1eb66bee99727cae64; from 2baec2c3f854d1f79c7bb28386484e144e864a14 before ac5f54691be06a32246179d41be2d73598036deb; from 2baec2c3f854d1f79c7bb28386484e144e864a14 before 146d4ab94cf129ee06cd467cb5c71368a6b5bad6	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.13.1 before 6.6.135; from 6.7 before 6.12.82; from 6.13 before 6.18.23; from 6.19 before 6.19.13; 4.13; 7.0; 7.0; 7.0; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/3e47a38e584b905359fe0ce5be5165d1e8592a90
https://git.kernel.org/stable/c/b15b1ce96777b88989a6a4de8d01efbcd81ad2d7
https://git.kernel.org/stable/c/280efb85e9759881a9d31d0874baa04583cb6c09
https://git.kernel.org/stable/c/93fc15be44a35b8e3c58d0238ac0d9b7c53465ff	patch
https://git.kernel.org/stable/c/c63abf25203b50243fe228090526f9dbf37727bd	patch
https://git.kernel.org/stable/c/3be718f659683ad89fad6f1eb66bee99727cae64	patch
https://git.kernel.org/stable/c/ac5f54691be06a32246179d41be2d73598036deb	patch
https://git.kernel.org/stable/c/146d4ab94cf129ee06cd467cb5c71368a6b5bad6	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.