CVE-2026-31400 | Linux Kernel up to 7.0-rc4 cache_release file descriptor consumption

VDB-355167 · CVE-2026-31400 · GCVE-0-2026-31400 LINUX KERNEL UP TO 7.0-RC4 CACHE_RELEASE FILE DESCRIPTOR CONSUMPTION HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 5.5 $0-$5k 0.65 Summaryinfo A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.0-rc4. Affected is the function cache_release. Performing a manipulation results in file descriptor consumption. This vulnerability is reported as CVE-2026-31400. No exploit exists. It is advisable to upgrade the affected component. Detailsinfo A vulnerability classified as critical has been found in Linux Kernel up to 7.0-rc4. This affects the function cache_release. The manipulation with an unknown input leads to a file descriptor consumption vulnerability. CWE is classifying the issue as CWE-769. This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774. This is going to have an impact on availability. The summary by CVE is: In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix cache_request leak in cache_release When a reader's file descriptor is closed while in the middle of reading a cache_request (rp->offset != 0), cache_release() decrements the request's readers count but never checks whether it should free the request. In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the cache_request is removed from the queue and freed along with its buffer and cache_head reference. cache_release() lacks this cleanup. The only other path that frees requests with readers == 0 is cache_dequeue(), but it runs only when CACHE_PENDING transitions from set to clear. If that transition already happened while readers was still non-zero, cache_dequeue() will have skipped the request, and no subsequent call will clean it up. Add the same cleanup logic from cache_read() to cache_release(): after decrementing readers, check if it reached 0 with CACHE_PENDING clear, and if so, dequeue and free the cache_request. It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-31400 since 03/09/2026. Technical details of the vulnerability are known, but there is no available exploit. Upgrading to version 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10 or 7.0-rc5 eliminates this vulnerability. Applying the patch 7bcd5e318876ac638c8ceade7a648e76ac8c48e1/41f6ba6c98a618043d2cd71030bf9a752dfab8b2/301670dcd098c1fe5c2fe90fb3c7a8f4814d2351/be5c35960e5ead70862736161836e2d1bc7352dc/373457de14281c1fc7cace6fc4c8a267fc176673/17ad31b3a43b72aec3a3d83605891e1397d0d065 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version. Productinfo Type Operating System Vendor Linux Name Kernel Version 6.1.166 6.6.129 6.12.0 6.12.1 6.12.2 6.12.3 6.12.4 6.12.5 6.12.6 6.12.7 6.12.8 6.12.9 6.12.10 6.12.11 6.12.12 6.12.13 6.12.14 6.12.15 6.12.16 6.12.17 6.12.18 6.12.19 6.12.20 6.12.21 6.12.22 6.12.23 6.12.24 6.12.25 6.12.26 6.12.27 6.12.28 6.12.29 6.12.30 6.12.31 6.12.32 6.12.33 6.12.34 6.12.35 6.12.36 6.12.37 6.12.38 6.12.39 6.12.40 6.12.41 6.12.42 6.12.43 6.12.44 6.12.45 6.12.46 6.12.47 6.12.48 6.12.49 6.12.50 6.12.51 6.12.52 6.12.53 6.12.54 6.12.55 6.12.56 6.12.57 6.12.58 6.12.59 6.12.60 6.12.61 6.12.62 6.12.63 6.12.64 6.12.65 6.12.66 6.12.67 6.12.68 6.12.69 6.12.70 6.12.71 6.12.72 6.12.73 6.12.74 6.12.75 6.12.76 6.12.77 6.18.0 6.18.1 6.18.2 6.18.3 6.18.4 6.18.5 6.18.6 6.18.7 6.18.8 6.18.9 6.18.10 6.18.11 6.18.12 6.18.13 6.18.14 6.18.15 6.18.16 6.18.17 6.18.18 6.18.19 6.19.0 6.19.1 6.19.2 6.19.3 6.19.4 6.19.5 6.19.6 6.19.7 6.19.8 6.19.9 7.0-rc1 7.0-rc2 7.0-rc3 7.0-rc4 License open-source Website Vendor: https://www.kernel.org/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 5.7 VulDB Meta Temp Score: 5.5 VulDB Base Score: 5.7 VulDB Temp Score: 5.5 VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: File descriptor consumption CWE: CWE-769 / CWE-400 / CWE-404 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Partially Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: Kernel 6.1.167/6.6.130/6.12.78/6.18.20/6.19.10/7.0-rc5 Patch: 7bcd5e318876ac638c8ceade7a648e76ac8c48e1/41f6ba6c98a618043d2cd71030bf9a752dfab8b2/301670dcd098c1fe5c2fe90fb3c7a8f4814d2351/be5c35960e5ead70862736161836e2d1bc7352dc/373457de14281c1fc7cace6fc4c8a267fc176673/17ad31b3a43b72aec3a3d83605891e1397d0d065 Timelineinfo 03/09/2026 CVE reserved 04/03/2026 +24 days Advisory disclosed 04/03/2026 +0 days VulDB entry created 04/03/2026 +0 days VulDB entry last update Sourcesinfo Vendor: kernel.org Advisory: git.kernel.org Status: Confirmed CVE: CVE-2026-31400 (🔒) GCVE (CVE): GCVE-0-2026-31400 GCVE (VulDB): GCVE-100-355167 Entryinfo Created: 04/03/2026 18:17 Changes: 04/03/2026 18:17 (58) Complete: 🔍 Cache ID: 99:E3A:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸