Medium 5.5Published Apr 3, 2026

CVE-2026-31400sunrpc: fix cache_request leak in cache_release

Updated under an hour ago (Oct 27, 2026, 3:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix cache_request leak in cache_release When a reader's file descriptor is closed while in the middle of reading a cache_request (rp->offset != 0), cache_release() decrements the request's readers count but never checks whether it should free the request. In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the cache_request is removed from the queue and freed along with its buffer and cache_head reference. cache_release() lacks this cleanup. The only other path that frees requests with readers == 0 is cache_dequeue(), but it runs only when CACHE_PENDING transitions from set to clear. If that transition already happened while readers was still non-zero, cache_dequeue() will have skipped the request, and no subsequent call will clean it up. Add the same cleanup logic from cache_read() to cache_release(): after decrementing readers, check if it reached 0 with CACHE_PENDING clear, and if so, dequeue and free the cache_request.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 1dfedb293943e491379c9302b428e6f920a73d12; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f18c1f2a88ca91357916997cdb0f7adaf14fc497; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7bcd5e318876ac638c8ceade7a648e76ac8c48e1; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 41f6ba6c98a618043d2cd71030bf9a752dfab8b2; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 301670dcd098c1fe5c2fe90fb3c7a8f4814d2351; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before be5c35960e5ead70862736161836e2d1bc7352dc; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 373457de14281c1fc7cace6fc4c8a267fc176673; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 17ad31b3a43b72aec3a3d83605891e1397d0d065	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.12.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 2.6.12; and 8 more ranges	NVD

References

References

https://git.kernel.org/stable/c/1dfedb293943e491379c9302b428e6f920a73d12	patch
https://git.kernel.org/stable/c/f18c1f2a88ca91357916997cdb0f7adaf14fc497	patch
https://git.kernel.org/stable/c/7bcd5e318876ac638c8ceade7a648e76ac8c48e1	patch
https://git.kernel.org/stable/c/41f6ba6c98a618043d2cd71030bf9a752dfab8b2	patch
https://git.kernel.org/stable/c/301670dcd098c1fe5c2fe90fb3c7a8f4814d2351	patch
https://git.kernel.org/stable/c/be5c35960e5ead70862736161836e2d1bc7352dc	patch
https://git.kernel.org/stable/c/373457de14281c1fc7cace6fc4c8a267fc176673	patch
https://git.kernel.org/stable/c/17ad31b3a43b72aec3a3d83605891e1397d0d065	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.