CVE-2026-31642: Linux Kernel Bug Can Hang Systems via Diagnostic File—Here’s the Fix

On April 24, 2026, the Linux kernel project disclosed a vulnerability in its RxRPC networking subsystem that can freeze systems when a diagnostic interface is read under the wrong conditions. Tracked as CVE-2026-31642, the flaw is not a remote code execution nightmare but a concurrency bug that can spin a CPU core into an infinite loop, causing denial of service on affected machines. Microsoft has listed the CVE in its Security Update Guide, a reminder that the issue reaches into Windows Subsystem for Linux 2 (WSL2) and Azure Linux workloads—even though the vulnerable code lives in the Linux kernel, not Windows.

The bug: how a wrong list deletion can lock up your system

The root cause is a mismatch in list handling inside the RxRPC implementation. When the kernel tears down an RxRPC call, it must remove that call from the rxnet->calls list. The list is read using the RCU (Read-Copy-Update) mechanism, a lightweight synchronization technique that allows lock-free traversal during reads. However, the teardown code was calling listdelinit()—a function that reinitializes the removed node’s pointers, creating a self-linked empty list. That’s safe for normal linked lists but dangerous under RCU, because a concurrent reader traversing the list may follow the corrupted pointers and never reach the end of the list.

The result: reading /proc/net/rxrpc/calls, a diagnostic file that dumps the list of active calls, while another CPU is removing a call can send the reader into an infinite loop. The kernel thread consuming CPU spins endlessly, leading to soft lockups, RCU stall warnings, and system sluggishness. The fix, committed upstream and now being backported by Linux vendors, replaces listdelinit() with listdelrcu() and consolidates call removal into a single function—rxrpcputcall()—so that the list never sees an improperly initialized node.

What it means for you: from desktops to cloud nodes

The practical impact varies sharply by environment:

• Home users and standalone desktops: If you run a typical Linux desktop and haven’t deliberately loaded the rxrpc kernel module or enabled the AFS filesystem client, you’re almost certainly safe. The vulnerable code path is reachable only when RxRPC functionality is built into the kernel and actively used. A quick check—lsmod | grep rxrpc—will show empty output on most consumer systems. However, some distributions ship the module by default, so verify rather than assume.

• System administrators and server operators: Any multi-user Linux server where RxRPC is available (check CONFIGAFRXRPC in /boot/config-$(uname -r)) could be exposed. The real danger is not a malicious attacker deliberately exploiting the bug but a routine monitoring script or an inquisitive admin session reading /proc/net/rxrpc/calls at the wrong instant. If that happens, the system can hang until a reboot. For servers running AFS, this is a high-priority fix; for others, it’s still a stability patch you want to apply during your next maintenance window.

• Containers and Kubernetes: Containers share the host kernel, so if a node’s kernel is vulnerable, every pod on that node is potentially affected, regardless of how patched the container image is. The attack surface is limited by container escape protections—an unprivileged container typically cannot read /proc/net/rxrpc/calls unless specifically allowed—but a container with CAPSYSADMIN or similar privileges could trigger the hang. The remediation is to update the node’s kernel and reboot; rolling node pools to a patched image is the cleanest path.

• WSL2 and Azure Linux: Microsoft tracks this CVE because its WSL2 kernel and various Azure Linux images ship the kernel code. For WSL2, you’ll need to run wsl --update and then wsl --shutdown to load the new kernel. On Azure, update the Linux VM image via your usual update mechanism, and ensure you reboot afterward—a live kernel update doesn’t count.

• Windows servers and desktops: If you’re running Windows natively (no WSL), this CVE does not affect you at all. The Microsoft advisory is purely informational for mixed environments.

How we got here: RxRPC, RCU, and the diagnostic trap

RxRPC is a remote procedure call protocol that Linux implements in the kernel. It sits on top of UDP and is used primarily by the in-kernel AFS client (kafs). Because RxRPC tracks many stateful objects—calls, connections, peers—the kernel keeps a linked list of all active calls for debugging via /proc/net/rxrpc/calls. That proc file is a convenience for developers and power users, but it can be read by any process with appropriate permissions (often root, but sometimes world-readable depending on the distro).

RCU, short for Read-Copy-Update, is the kernel’s way of allowing readers to traverse data structures without locking while writers update or remove entries in the background. For lists, that means writers must use RCU-aware deletion functions that preserve the list’s forward and backward pointers long enough for any in-flight readers to finish. The original code violated this contract.

The bug was introduced in an earlier kernel version and went unnoticed because triggering it requires a precise race: a reader of the proc file and a writer tearing down a call at the same moment. That’s rare on systems that don’t use RxRPC, but it’s a ticking time bomb for anyone who does. The vulnerability was reported through kernel.org, and the fix landed in upstream stable trees. Because kernel CVEs often lack immediate CVSS scores—the National Vulnerability Database had not yet enriched CVE-2026-31642 as of this writing—the severity must be assessed locally. For most admins, it’s a moderate availability issue, not a critical remote compromise.

What to do now: a straightforward patch and mitigation plan

The only true fix is a kernel update from your Linux distribution. Follow these steps to get patched and stay safe.

1. Check if you’re vulnerable

Run these commands on every Linux machine you manage:

# Kernel version
uname -r

Is RxRPC built in?

Is the module loaded?

Does the diagnostic file exist?

If CONFIGAFRXRPC=y or =m appears, your kernel has the code. If the module is loaded, you’re directly exposed. If the proc file exists, any read of it could trigger the hang.

2. Apply the vendor kernel patch

Use your package manager to update:

• Debian/Ubuntu: sudo apt update && sudo apt upgrade
• RHEL/CentOS/Fedora: sudo dnf update (or yum update on older systems)
• SUSE/openSUSE: sudo zypper up
• Arch: sudo pacman -Syu

For WSL2, use wsl --update from a Windows command prompt.

3. Reboot into the new kernel

Installing a kernel package is not enough. You must restart to load the patched version. After rebooting, verify with uname -r that you’re not still running the old kernel. If the old kernel remains as a fallback in your boot menu, remove it or ensure your security tools ignore it—an unpatched kernel that’s bootable is a liability.

4. Consider a temporary mitigation if patching is delayed

If you cannot immediately reboot and you don’t need RxRPC, disable the modules:

sudo modprobe -r kafs rxkad rxrpc

Prevent future loads

or: sudo dracut -f # RHEL/Fedora

Then reboot when you can. Do not blacklist these modules if you use AFS—that will break functionality.

5. For Kubernetes and cloud nodes

• Identify node images that include the vulnerable kernel.
• Roll out a new image with the patched kernel (e.g., apt-get update && apt-get upgrade && packer build).
• Cordon, drain, and replace nodes, or perform a rolling restart that loads the new kernel.
• Validate with uname -r on each node and ensure the old kernel is not offered as a boot option.

6. Monitor for signs of exploitation

If you suspect a hang has already occurred, look for:

• Kernel messages: `dmesg | grep -i