CVE-2026-31676

A flaw was found in the rxrpc subsystem of the Linux kernel. This vulnerability allows for duplicate or late RESPONSE packets to be processed outside of the expected service challenging state. An attacker could potentially exploit this by sending specially crafted RESPONSE packets, leading to the re-execution of the setup path. This could result in unexpected system behavior or resource consumption.

RxRPC service challenges now ignore stray RESPONSE frames outside the expected state machine window. Red Hat classifies this as protocol hardening against duplicate/late packets.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.