High 7.5Published Apr 25, 2026

CVE-2026-31676rxrpc: only handle RESPONSE during service challenge

Updated under an hour ago (Oct 27, 2026, 6:50 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challenge Only process RESPONSE packets while the service connection is still in RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before running response verification and security initialization, then use a local secured flag to decide whether to queue the secured-connection work after the state transition. This keeps duplicate or late RESPONSE packets from re-running the setup path and removes the unlocked post-transition state test.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 17926a79320afa9b95df6b977b40cca6d8713cea before a1a8efde03a40b6c658d580e96644d9b9a2a0d3a; 17926a79320afa9b95df6b977b40cca6d8713cea builds before 6c3a0fbdafef8316e34ae22333e317a341e737cd; 17926a79320afa9b95df6b977b40cca6d8713cea builds before 0afdfd4941c1b60a1f5c361760daa970edca60cd; from 17926a79320afa9b95df6b977b40cca6d8713cea before a6bcf8010af093fe04f7100562e9542ab7882585; 17926a79320afa9b95df6b977b40cca6d8713cea builds before 29b44d904dceb832be880def08b8cb17a0aba91c; from 17926a79320afa9b95df6b977b40cca6d8713cea before d0035e634dae83237ab7f5681eb52b2f65d0ceb8; 17926a79320afa9b95df6b977b40cca6d8713cea builds before 03fd2ef73cb4ffd0af100a95b634af54f474414e; from 17926a79320afa9b95df6b977b40cca6d8713cea before c43ffdcfdbb5567b1f143556df8a04b4eeea041c	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.22 before 6.6.136; from 6.7 before 6.12.84; from 6.13 before 6.18.23; from 6.19 before 6.19.13; 7.0; 7.0; 7.0; 7.0; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/a1a8efde03a40b6c658d580e96644d9b9a2a0d3a
https://git.kernel.org/stable/c/6c3a0fbdafef8316e34ae22333e317a341e737cd
https://git.kernel.org/stable/c/0afdfd4941c1b60a1f5c361760daa970edca60cd
https://git.kernel.org/stable/c/a6bcf8010af093fe04f7100562e9542ab7882585	patch
https://git.kernel.org/stable/c/29b44d904dceb832be880def08b8cb17a0aba91c	patch
https://git.kernel.org/stable/c/d0035e634dae83237ab7f5681eb52b2f65d0ceb8	patch
https://git.kernel.org/stable/c/03fd2ef73cb4ffd0af100a95b634af54f474414e	patch
https://git.kernel.org/stable/c/c43ffdcfdbb5567b1f143556df8a04b4eeea041c	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.