In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
Jan Schunk reports that his small NFS servers suffer from memory exhaustion after just a few days. A bisect shows that commit e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") is the first bad commit.
That commit assumed that sock_sendmsg() releases all the pages in the underlying bio_vec array, but the reality is that it doesn't. svc_xprt_release() releases the rqst's response pages, but the record marker page fragment isn't one of those, so it is never released.
This is a narrow fix that can be applied to stable kernels. A more extensive fix is in the works.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 19, 2024 |
| Ubuntu | — | Upgrade linux-image-raspiUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-lowlatency-64kUpgrade linux-image-azureUpgrade linux-image-awsUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-lowlatencyUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-ibmUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-virtualUpgrade linux-image-intelUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-nvidiaUpgrade linux-image-genericUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-gkeUpgrade linux-image-gcpUpgrade linux-image-oracleUpgrade linux-image-oem-24.04aUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-38-generic | Jul 12, 2024 | May 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub