A defect in the Linux kernel’s sunrpc subsystem prevents proper cleanup of a cache_request object when a client’s file descriptor is closed during a read. The bug allows the request object to remain allocated when the active reader count drops to zero and the pending flag is cleared, leading to a memory leak in the kernel. Repeated occurrence could cause kernel memory exhaustion, reducing system responsiveness or forcing a reboot.

This issue applies to all Linux kernel versions that lack the recent commit correcting the cache_release cleanup logic. No specific distribution or kernel series is listed, so the vulnerability is potentially present in any unpatched system that has a kernel older than the patch. Administrators should verify that the running kernel includes the commit that adds the missing cleanup in cache_release.

The flaw does not provide an obvious remote code execution path and is limited to local users or those able to execute kernel modules. Because no EPSS score is available and the vulnerability is not catalogued in CISA’s Known Exploited Vulnerabilities list, widespread exploitation is unlikely. However, an attacker with local access could repeatedly trigger the scenario, progressively draining kernel memory and potentially causing a denial of service. The risk is moderate, mainly due to the impact on availability rather than confidentiality or integrity.