---
id: CVE-2026-31639
title: 'rxrpc: Fix key reference count leak from call->key'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rxrpc: Fix key reference count leak from call->key

  When creating a client call in rxrpc_alloc_client_call(), the code obtains
  a reference to the key.  This is never cl…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f3441d4125fc98995858550a5521b8d7daf0504a <
    f1a7a3ab0f35f83cf11bba906b9e948cf3788c28
  - >-
    Linux >= f3441d4125fc98995858550a5521b8d7daf0504a <
    e6b7943c5dc875647499da09bf4d50a8557ab0c3
  - >-
    Linux >= f3441d4125fc98995858550a5521b8d7daf0504a <
    2e6ef713b1598f6acd7f302fa6b12b6731c89914
  - >-
    Linux >= f3441d4125fc98995858550a5521b8d7daf0504a <
    978108902ee4ef2b348ff7ec36ad014dc5bc6dc6
  - >-
    Linux >= f3441d4125fc98995858550a5521b8d7daf0504a <
    d666540d217e8d420544ebdfbadeedd623562733
  - Linux 6.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:23:18.427651Z'
published: '2026-04-24'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:20.884Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31639'
references:
  - url: 'https://git.kernel.org/stable/c/f1a7a3ab0f35f83cf11bba906b9e948cf3788c28'
  - url: 'https://git.kernel.org/stable/c/e6b7943c5dc875647499da09bf4d50a8557ab0c3'
  - url: 'https://git.kernel.org/stable/c/2e6ef713b1598f6acd7f302fa6b12b6731c89914'
  - url: 'https://git.kernel.org/stable/c/978108902ee4ef2b348ff7ec36ad014dc5bc6dc6'
  - url: 'https://git.kernel.org/stable/c/d666540d217e8d420544ebdfbadeedd623562733'
tags:
  - cve.org
epss: 0.00122
epssPercentile: 0.01996
ingestedAt: '2026-11-06T15:54:04.051Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix key reference count leak from call->key

When creating a client call in rxrpc_alloc_client_call(), the code obtains
a reference to the key.  This is never cleaned up and gets leaked when the
call is destroyed.

Fix this by freeing call->key in rxrpc_destroy_call().

Before the patch, it shows the key reference counter elevated:

$ cat /proc/keys | grep afs@54321
1bffe9cd I--Q--i 8053480 4169w 3b010000  1000  1000 rxrpc     afs@54321: ka
$

After the patch, the invalidated key is removed when the code exits:

$ cat /proc/keys | grep afs@54321
$

## Affected

- `Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < f1a7a3ab0f35f83cf11bba906b9e948cf3788c28`
- `Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < e6b7943c5dc875647499da09bf4d50a8557ab0c3`
- `Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < 2e6ef713b1598f6acd7f302fa6b12b6731c89914`
- `Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < 978108902ee4ef2b348ff7ec36ad014dc5bc6dc6`
- `Linux >= f3441d4125fc98995858550a5521b8d7daf0504a < d666540d217e8d420544ebdfbadeedd623562733`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.