Executive brief
A memory leak vulnerability was identified in the Linux kernel's SunRPC component, which handles remote procedure calls for network file systems. If a user closes a specific type of file while a data request is still being processed, the system fails to release the associated memory. Over time, an attacker could repeatedly trigger this behavior to exhaust system memory, potentially leading to a system crash or service outage.
Technical details
A memory leak exists in net/sunrpc/cache.c within the Linux kernel. When a reader's file descriptor is closed while in the middle of reading a cache_request (specifically when rp->offset is non-zero), the cache_release() function decrements the request's reader count but fails to check if the request should be freed. This occurs because cache_release() lacks the cleanup logic found in cache_read(), which handles cases where the reader count drops to zero while CACHE_PENDING is clear. A local attacker can exploit this by repeatedly opening and closing file descriptors during cache requests to exhaust kernel memory. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel 2.6.12.1 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10
Timeline
- 2026-04-03: disclosed: Initial disclosure of CVE-2026-31400
- 2026-04-03: advisory
- 2026-04-18: patched: Patch committed to stable tree by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/17ad31b3a43b72aec3a3d83605891e1397d0d065
- https://git.kernel.org/stable/c/1dfedb293943e491379c9302b428e6f920a73d12
- https://git.kernel.org/stable/c/301670dcd098c1fe5c2fe90fb3c7a8f4814d2351
- https://git.kernel.org/stable/c/373457de14281c1fc7cace6fc4c8a267fc176673
- https://git.kernel.org/stable/c/41f6ba6c98a618043d2cd71030bf9a752dfab8b2
- https://git.kernel.org/stable/c/7bcd5e318876ac638c8ceade7a648e76ac8c48e1
- https://git.kernel.org/stable/c/be5c35960e5ead70862736161836e2d1bc7352dc