Answer in brief
CVE-2026-31676 records a High severity (CVSS 7.5) vulnerability in rxrpc: only handle RESPONSE during service challenge. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=17926a79320afa9b95df6b977b40cca6d8713cea <a1a8efde03a40b6c658d580e96644d9b9a2a0d3a || >=17926a79320afa9b95df6b977b40cca6d8713cea <6c3a0fbdafef8316e34ae22333e317a341e737cd || >=17926a79320afa9b95df6b977b40cca6d8713cea <0afdfd4941c1b60a1f5c361760daa970edca60cd || >=17926a79320afa9b95df6b977b40cca6d8713cea <a6bcf8010af093fe04f7100562e9542ab7882585 || >=17926a79320afa9b95df6b977b40cca6d8713cea <29b44d904dceb832be880def08b8cb17a0aba91c || >=17926a79320afa9b95df6b977b40cca6d8713cea <d0035e634dae83237ab7f5681eb52b2f65d0ceb8 || >=17926a79320afa9b95df6b977b40cca6d8713cea <03fd2ef73cb4ffd0af100a95b634af54f474414e || >=17926a79320afa9b95df6b977b40cca6d8713cea <c43ffdcfdbb5567b1f143556df8a04b4eeea041c | a1a8efde03a40b6c658d580e96644d9b9a2a0d3a, 6c3a0fbdafef8316e34ae22333e317a341e737cd, 0afdfd4941c1b60a1f5c361760daa970edca60cd, a6bcf8010af093fe04f7100562e9542ab7882585, 29b44d904dceb832be880def08b8cb17a0aba91c, d0035e634dae83237ab7f5681eb52b2f65d0ceb8, 03fd2ef73cb4ffd0af100a95b634af54f474414e, c43ffdcfdbb5567b1f143556df8a04b4eeea041c |
| Linux/Linuxgeneric | 2.6.22 | Not reported |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
Published upstream
Apr 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
In the Linux kernel, the following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challenge Only process RESPONSE packets while the service connection is still in RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before running response verification and security initialization, then use a local secured flag to decide whether to queue the secured-connection work after the state transition. This keeps duplicate or late RESPONSE packets from re-running the setup path and removes the unlocked post-transition state test.
Quoted source text, attributed separately from HOL analysis.