---
id: CVE-2026-31638
title: 'rxrpc: Only put the call ref if one was acquired'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rxrpc: Only put the call ref if one was acquired

  rxrpc_input_packet_on_conn() can process a to-client packet after the
  current client call on the channel has already b…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5e6ef4f1017c7f844e305283bbd8875af475e2fc <
    b8f66447448d6c305a51413a67ec8ed26aa7d1dd
  - >-
    Linux >= 5e6ef4f1017c7f844e305283bbd8875af475e2fc <
    0c156aff8a2d4fa0d61db7837641975cf0e5452d
  - >-
    Linux >= 5e6ef4f1017c7f844e305283bbd8875af475e2fc <
    8299ca146489664e3c0c90a3b8900d8335b1ede4
  - >-
    Linux >= 5e6ef4f1017c7f844e305283bbd8875af475e2fc <
    9fb09861e2b8d1abfe2efaf260c9f1d30080ea38
  - >-
    Linux >= 5e6ef4f1017c7f844e305283bbd8875af475e2fc <
    6331f1b24a3e85465f6454e003a3e6c22005a5c5
  - Linux 6.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:11:27.061889Z'
published: '2026-04-24'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:18.015Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31638'
references:
  - url: 'https://git.kernel.org/stable/c/b8f66447448d6c305a51413a67ec8ed26aa7d1dd'
  - url: 'https://git.kernel.org/stable/c/0c156aff8a2d4fa0d61db7837641975cf0e5452d'
  - url: 'https://git.kernel.org/stable/c/8299ca146489664e3c0c90a3b8900d8335b1ede4'
  - url: 'https://git.kernel.org/stable/c/9fb09861e2b8d1abfe2efaf260c9f1d30080ea38'
  - url: 'https://git.kernel.org/stable/c/6331f1b24a3e85465f6454e003a3e6c22005a5c5'
tags:
  - cve.org
epss: 0.0063
epssPercentile: 0.49107
ingestedAt: '2026-10-16T17:24:46.664Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Only put the call ref if one was acquired

rxrpc_input_packet_on_conn() can process a to-client packet after the
current client call on the channel has already been torn down.  In that
case chan->call is NULL, rxrpc_try_get_call() returns NULL and there is
no reference to drop.

The client-side implicit-end error path does not account for that and
unconditionally calls rxrpc_put_call().  This turns a protocol error
path into a kernel crash instead of rejecting the packet.

Only drop the call reference if one was actually acquired.  Keep the
existing protocol error handling unchanged.

## Affected

- `Linux >= 5e6ef4f1017c7f844e305283bbd8875af475e2fc < b8f66447448d6c305a51413a67ec8ed26aa7d1dd`
- `Linux >= 5e6ef4f1017c7f844e305283bbd8875af475e2fc < 0c156aff8a2d4fa0d61db7837641975cf0e5452d`
- `Linux >= 5e6ef4f1017c7f844e305283bbd8875af475e2fc < 8299ca146489664e3c0c90a3b8900d8335b1ede4`
- `Linux >= 5e6ef4f1017c7f844e305283bbd8875af475e2fc < 9fb09861e2b8d1abfe2efaf260c9f1d30080ea38`
- `Linux >= 5e6ef4f1017c7f844e305283bbd8875af475e2fc < 6331f1b24a3e85465f6454e003a3e6c22005a5c5`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.