AZL-83816
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-83816.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-83816
- Upstream
- Published
- 2026-04-24T15:16:43Z
- Modified
- 2026-08-28T17:48:03.347167070Z
- Summary
- CVE-2026-31639 affecting package kernel for versions less than 6.6.137.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix key reference count leak from call->key
When creating a client call in rxrpcallocclient_call(), the code obtains a reference to the key. This is never cleaned up and gets leaked when the call is destroyed.
Fix this by freeing call->key in rxrpcdestroycall().
Before the patch, it shows the key reference counter elevated:
$ cat /proc/keys | grep afs@54321 1bffe9cd I--Q--i 8053480 4169w 3b010000 1000 1000 rxrpc afs@54321: ka $
After the patch, the invalidated key is removed when the code exits:
$ cat /proc/keys | grep afs@54321 $
- References