VulnerabilityPublished 3 Apr 2026Updated 5 Nov 2026

CVE-2026-31400: Linux kernel · sunrpc: fix cache_request leak in cache_release

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f18c1f2a88ca91357916997cdb0f7adaf14fc497 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 22:04 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in f18c1f2a88ca91357916997cdb0f7adaf14fc497, be5c35960e5ead70862736161836e2d1bc7352dc, 373457de14281c1fc7cace6fc4c8a267fc176673 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < f18c1f2a88ca91357916997cdb0f7adaf14fc497	Fixed in f18c1f2a88ca91357916997cdb0f7adaf14fc497
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < be5c35960e5ead70862736161836e2d1bc7352dc	Fixed in be5c35960e5ead70862736161836e2d1bc7352dc
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 373457de14281c1fc7cace6fc4c8a267fc176673	Fixed in 373457de14281c1fc7cace6fc4c8a267fc176673
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 301670dcd098c1fe5c2fe90fb3c7a8f4814d2351	Fixed in 301670dcd098c1fe5c2fe90fb3c7a8f4814d2351
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 41f6ba6c98a618043d2cd71030bf9a752dfab8b2	Fixed in 41f6ba6c98a618043d2cd71030bf9a752dfab8b2
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 17ad31b3a43b72aec3a3d83605891e1397d0d065	Fixed in 17ad31b3a43b72aec3a3d83605891e1397d0d065

Description

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix cache_request leak in cache_release When a reader's file descriptor is closed while in the middle of reading a cache_request (rp->offset != 0), cache_release() decrements the request's readers count but never checks whether it should free the request. In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the cache_request is removed from the queue and freed along with its buffer and cache_head reference. cache_release() lacks this cleanup. The only other path that frees requests with readers == 0 is cache_dequeue(), but it runs only when CACHE_PENDING transitions from set to clear. If that transition already happened while readers was still non-zero, cache_dequeue() will have skipped the request, and no subsequent call will clean it up. Add the same cleanup logic from cache_read() to cache_release(): after decrementing readers, check if it reached 0 with CACHE_PENDING clear, and if so, dequeue and free the cache_request.

References

Community reviews

Loading reviews…