CVE-2026-31400In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix cache_request leak in cache_release When a reader's file descriptor is closed while in the middle of reading a cache_re…
Updated under an hour ago ()
Does this affect you?
It affects linux_kernel. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix cache_request leak in cache_release When a reader's file descriptor is closed while in the middle of reading a cache_request (rp->offset != 0), cache_release() decrements the request's readers count but never checks whether it should free the request. In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the cache_request is removed from the queue and freed along with its buffer and cache_head reference. cache_release() lacks this cleanup. The only other path that frees requests with readers == 0 is cache_dequeue(), but it runs only when CACHE_PENDING transitions from set to clear. If that transition already happened while readers was still non-zero, cache_dequeue() will have skipped the request, and no subsequent call will clean it up. Add the same cleanup logic from cache_read() to cache_release(): after decrementing readers, check if it reached 0 with CACHE_PENDING clear, and if so, dequeue and free the cache_request.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-401
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jul 24, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
linux linux_kernel linux:linux_kernel | from 2.6.12.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 2.6.12; and 8 more ranges | NVD |
References
- https://git.kernel.org/stable/c/17ad31b3a43b72aec3a3d83605891e1397d0d065patch
- https://git.kernel.org/stable/c/1dfedb293943e491379c9302b428e6f920a73d12patch
- https://git.kernel.org/stable/c/301670dcd098c1fe5c2fe90fb3c7a8f4814d2351patch
- https://git.kernel.org/stable/c/373457de14281c1fc7cace6fc4c8a267fc176673patch
- https://git.kernel.org/stable/c/41f6ba6c98a618043d2cd71030bf9a752dfab8b2patch
- https://git.kernel.org/stable/c/7bcd5e318876ac638c8ceade7a648e76ac8c48e1patch
- https://git.kernel.org/stable/c/be5c35960e5ead70862736161836e2d1bc7352dcpatch
- https://git.kernel.org/stable/c/f18c1f2a88ca91357916997cdb0f7adaf14fc497patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.