CVE-2026-31400

Vulnerability

CVE-2026-31400 is a memory leak vulnerability in the Linux kernel's sunrpc subsystem. When a reader closes its file descriptor while in the middle of reading a cache_request (indicated by rp->offset != 0), the cache_release() function decrements the request's reader count but fails to check whether the request should be freed. This occurs because the cleanup logic present in cache_read()—which frees the request when readers reach zero and CACHE_PENDING is clear—is missing in cache_release(). Additionally, cache_dequeue() only cleans up when CACHE_PENDING transitions from set to clear; if that transition happens while readers are still non-zero, the request is never freed [1][2].

Exploitation

An attacker with the ability to open and read sunrpc cache files (typically requiring local access or a container breakout) can cause repeated partial reads and close the file descriptor before completing a read. This action triggers the leak each time, as the kernel fails to release the memory allocated for the cache_request structure and its associated buffer and cache_head reference [3]. No special privileges beyond read access to the cache are needed.

Impact

By repeatedly opening cache files and closing them mid-read, an attacker can exhaust kernel memory, leading to a denial-of-service (DoS) condition. The leak is per-operation, so sustained exploitation can eventually cause system instability or panic due to memory starvation. The CVSS v3 score of 5.5 reflects the medium severity, with local access required and availability impact [4].

Mitigation

The vulnerability is fixed in Linux kernel stable releases that include commits 373457de1428, 301670dcd098, be5c35960e5a, and f18c1f2a88ca [1][2][3][4]. Users should update their kernels to the latest patched versions. No workaround is available; the fix must be applied via a kernel update.