HomeDefectsLIN1025-13777
Acknowledged

LIN1025-13777 : Security Advisory - linux - CVE-2026-31639

Created: Apr 27, 2026    Updated: Apr 30, 2026
Found In Version: 10.25.33.2
Severity: Standard
Applicable for: Wind River Linux LTS 25
Component/s: Kernel

Description

In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix key reference count leak from call->key  When creating a client call in rxrpc_alloc_client_call(), the code obtains a reference to the key.  This is never cleaned up and gets leaked when the call is destroyed.  Fix this by freeing call->key in rxrpc_destroy_call().  Before the patch, it shows the key reference counter elevated:  $ cat /proc/keys | grep afs@54321 1bffe9cd I--Q--i 8053480 4169w 3b010000  1000  1000 rxrpc     afs@54321: ka $  After the patch, the invalidated key is removed when the code exits:  $ cat /proc/keys | grep afs@54321 $