CVE-2026-31642
Gravedad:
Pendiente de análisis
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
24/04/2026
Última modificación:
24/04/2026
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
rxrpc: Fix call removal to use RCU safe deletion<br />
<br />
Fix rxrpc call removal from the rxnet->calls list to use list_del_rcu()<br />
rather than list_del_init() to prevent stuffing up reading<br />
/proc/net/rxrpc/calls from potentially getting into an infinite loop.<br />
<br />
This, however, means that list_empty() no longer works on an entry that&#39;s<br />
been deleted from the list, making it harder to detect prior deletion. Fix<br />
this by:<br />
<br />
Firstly, make rxrpc_destroy_all_calls() only dump the first ten calls that<br />
are unexpectedly still on the list. Limiting the number of steps means<br />
there&#39;s no need to call cond_resched() or to remove calls from the list<br />
here, thereby eliminating the need for rxrpc_put_call() to check for that.<br />
<br />
rxrpc_put_call() can then be fixed to unconditionally delete the call from<br />
the list as it is the only place that the deletion occurs.
Impacto
Referencias a soluciones, herramientas e información
- https://git.kernel.org/stable/c/146d4ab94cf129ee06cd467cb5c71368a6b5bad6
- https://git.kernel.org/stable/c/3be718f659683ad89fad6f1eb66bee99727cae64
- https://git.kernel.org/stable/c/93fc15be44a35b8e3c58d0238ac0d9b7c53465ff
- https://git.kernel.org/stable/c/ac5f54691be06a32246179d41be2d73598036deb
- https://git.kernel.org/stable/c/c63abf25203b50243fe228090526f9dbf37727bd



