CVE-2026-31400

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: fix cache_request leak in cache_release

When a reader's file descriptor is closed while in the middle of reading

a cache_request (rp->offset != 0), cache_release() decrements the

request's readers count but never checks whether it should free the

request.

In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the

cache_request is removed from the queue and freed along with its buffer

and cache_head reference. cache_release() lacks this cleanup.

The only other path that frees requests with readers == 0 is

cache_dequeue(), but it runs only when CACHE_PENDING transitions from

set to clear. If that transition already happened while readers was

still non-zero, cache_dequeue() will have skipped the request, and no

subsequent call will clean it up.

Add the same cleanup logic from cache_read() to cache_release(): after

decrementing readers, check if it reached 0 with CACHE_PENDING clear,

and if so, d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References