CVE-2026-31400: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31400 is a memory leak vulnerability in the Linux kernel's sunrpc subsystem, specifically in the cache_release() function. When a reader's file descriptor is closed mid-read of a cache_request (i.e., rp->offset != 0), the function decrements the request's readers count but fails to free the request when readers reaches 0 and CACHE_PENDING is clear. This affects Linux kernel versions from 2.6.12 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, and 7.0-rc5. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In cache_read(), when the readers count drops to 0 and CACHE_PENDING is clear, the cache_request is dequeued and freed along with its buffer and cache_head reference. However, cache_release() — called when a file descriptor is closed — decrements the readers count without performing this same cleanup. The only other cleanup path, cache_dequeue(), only runs when CACHE_PENDING transitions from set to clear; if that transition already occurred while readers was non-zero, cache_dequeue() skips the request and no subsequent call reclaims it. The fix mirrors the cleanup logic from cache_read() into cache_release(): after decrementing readers, check if it reached 0 with CACHE_PENDING clear, and if so, dequeue and free the cache_request (GitHub Advisory).

Successful exploitation leads to kernel memory exhaustion and denial of service. A local user with low privileges can repeatedly open and close file descriptors while reading sunrpc cache entries, causing cache_request objects to accumulate without being freed. Over time, this degrades system performance and can cause kernel instability or crashes. The impact is confined to kernel memory management within the sunrpc subsystem, with no confidentiality or integrity impact (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The EPSS score is approximately 0.024% (very low probability of exploitation in the near term). The vulnerability requires local access with low privileges (no user interaction needed), limiting its attack surface. It has not been added to the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

Update the Linux kernel to a patched version corresponding to your supported branch: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, or 7.0-rc5 and later. Vendor-specific updates are available from Amazon Linux (ALAS2023-2026-1594, ALAS2023-2026-1681, ALAS2KERNEL-5.15-2026-102), SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), and Debian. If immediate patching is not feasible, restrict local user access to systems running NFS/sunrpc services and monitor kernel memory usage for unusual growth (GitHub Advisory, Feedly).