{"id":"CVE-2026-31639","title":"rxrpc: Fix key reference count leak from call->key","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix key reference count leak from call->key\n\nWhen creating a client call in rxrpc_alloc_client_call(), the code obtains\na reference to the key.  This is never cl…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < f1a7a3ab0f35f83cf11bba906b9e948cf3788c28","Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < e6b7943c5dc875647499da09bf4d50a8557ab0c3","Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < 2e6ef713b1598f6acd7f302fa6b12b6731c89914","Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < 978108902ee4ef2b348ff7ec36ad014dc5bc6dc6","Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < d666540d217e8d420544ebdfbadeedd623562733","Linux 6.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:23:18.427651Z"},"published":"2026-04-24","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:32:20.884Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31639","references":[{"url":"https://git.kernel.org/stable/c/f1a7a3ab0f35f83cf11bba906b9e948cf3788c28"},{"url":"https://git.kernel.org/stable/c/e6b7943c5dc875647499da09bf4d50a8557ab0c3"},{"url":"https://git.kernel.org/stable/c/2e6ef713b1598f6acd7f302fa6b12b6731c89914"},{"url":"https://git.kernel.org/stable/c/978108902ee4ef2b348ff7ec36ad014dc5bc6dc6"},{"url":"https://git.kernel.org/stable/c/d666540d217e8d420544ebdfbadeedd623562733"}],"tags":["cve.org"],"epss":0.00122,"epssPercentile":0.01996,"ingestedAt":"2026-11-06T15:54:04.051Z","slug":"CVE-2026-31639","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix key reference count leak from call->key\n\nWhen creating a client call in rxrpc_alloc_client_call(), the code obtains\na reference to the key.  This is never cleaned up and gets leaked when the\ncall is destroyed.\n\nFix this by freeing call->key in rxrpc_destroy_call().\n\nBefore the patch, it shows the key reference counter elevated:\n\n$ cat /proc/keys | grep afs@54321\n1bffe9cd I--Q--i 8053480 4169w 3b010000  1000  1000 rxrpc     afs@54321: ka\n$\n\nAfter the patch, the invalidated key is removed when the code exits:\n\n$ cat /proc/keys | grep afs@54321\n$\n\n## Affected\n\n- `Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < f1a7a3ab0f35f83cf11bba906b9e948cf3788c28`\n- `Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < e6b7943c5dc875647499da09bf4d50a8557ab0c3`\n- `Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < 2e6ef713b1598f6acd7f302fa6b12b6731c89914`\n- `Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < 978108902ee4ef2b348ff7ec36ad014dc5bc6dc6`\n- `Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < d666540d217e8d420544ebdfbadeedd623562733`\n- `Linux 6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}