CVE-2026-31640 PUBLISHED

rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial

Assigner: Linux
Reserved: 09.03.2026 Published: 24.04.2026 Updated: 24.04.2026

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial

In rxrpc_post_response(), the code should be comparing the challenge serial number from the cached response before deciding to switch to a newer response, but looks at the newer packet private data instead, rendering the comparison always false.

Fix this by switching to look at the older packet.

Fix further[1] to substitute the new packet in place of the old one if newer and also to release whichever we don't use.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 5800b1cf3fd8ccab752a101865be1e76dac33142 to 9132b1a7bf83b4a8042fffbc99d075b727a16742 (excl.)
  • affected from 5800b1cf3fd8ccab752a101865be1e76dac33142 to 20386e7f8d97475b8d815873e246423317ec4260 (excl.)
  • affected from 5800b1cf3fd8ccab752a101865be1e76dac33142 to b33f5741bb187db8ff32e8f5b96def77cc94dfca (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.16 is affected
  • unaffected from 0 to 6.16 (excl.)
  • unaffected from 6.18.23 to 6.18.* (incl.)
  • unaffected from 6.19.13 to 6.19.* (incl.)
  • unaffected from 7.0 to * (incl.)

References