CVE-2026-31400
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, a memory leak has been found in the cache_release function in the sunrpc subsystem. When a reader's file descriptor is closed while reading a cache_request (rp->offset != 0), cache_release() decrements the readers count but never checks whether it should free the request. This can lead to a memory leak if CACHE_PENDING is clear and readers drop to zero.
Risk Assessment
Memory leak can lead to exhaustion of system resources and potential denial of service (DoS) in systems using RPC services.
Recommendation
Update the Linux kernel to a version containing the fix. Monitor memory usage in systems with RPC services.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix cache_request leak in cache_release When a reader's file descriptor is closed while in the middle of reading a cache_request (rp->offset != 0), cache_release() decrements the request's readers count but never checks whether it should free the request. In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the cache_request is removed from the queue and freed along with its buffer and cache_head reference. cache_release() lacks this cleanup. The only other path that frees requests with readers == 0 is cache_dequeue(), but it runs only when CACHE_PENDING transitions from set to clear. If that transition already happened while readers was still non-zero, cache_dequeue() will have skipped the request, and no subsequent call will clean it up. Add the same cleanup logic from cache_read() to cache_release(): after decrementing readers, check if it reached 0 with CACHE_PENDING clear, and if so, dequeue and free the cache_request.