CVE-2026-31640

A flaw was found in the Linux kernel's rxrpc component. This vulnerability occurs in the rxrpc_post_response() function, where the system incorrectly compares a newer network packet's data instead of the expected cached response. This error causes the challenge serial number comparison to always be false, preventing the system from correctly evaluating and potentially switching to newer network responses. This could lead to the system operating with outdated information or processing network communications incorrectly, potentially impacting the reliability of network services.

Red Hat has evaluated this issue as having a Moderate severity impact because an unprivileged local user can trigger degraded network service reliability or denial of service through faulty socket buffer handling in the RxRPC protocol, without compromising confidentiality or integrity. Exploitation requires the AF_RXRPC protocol stack to be active, which is not commonly enabled in standard server deployments. Furthermore, the vulnerable logic was introduced in newer upstream kernels and is not present in Red Hat Enterprise Linux 9 or earlier releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.