CVE-2026-31676
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
25/04/2026
Última modificación:
27/04/2026
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
rxrpc: only handle RESPONSE during service challenge<br />
<br />
Only process RESPONSE packets while the service connection is still in<br />
RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before<br />
running response verification and security initialization, then use a local<br />
secured flag to decide whether to queue the secured-connection work after<br />
the state transition. This keeps duplicate or late RESPONSE packets from<br />
re-running the setup path and removes the unlocked post-transition state<br />
test.
Impacto
Puntuación base 3.x
7.50
Gravedad 3.x
ALTA
Referencias a soluciones, herramientas e información
- https://git.kernel.org/stable/c/03fd2ef73cb4ffd0af100a95b634af54f474414e
- https://git.kernel.org/stable/c/29b44d904dceb832be880def08b8cb17a0aba91c
- https://git.kernel.org/stable/c/a6bcf8010af093fe04f7100562e9542ab7882585
- https://git.kernel.org/stable/c/c43ffdcfdbb5567b1f143556df8a04b4eeea041c
- https://git.kernel.org/stable/c/d0035e634dae83237ab7f5681eb52b2f65d0ceb8