CVE-2024-35882 (GCVE-0-2024-35882)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:34 – Updated: 2026-08-05 11:30
VLAI
Title
SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
Summary
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP Jan Schunk reports that his small NFS servers suffer from memory exhaustion after just a few days. A bisect shows that commit e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") is the first bad commit. That commit assumed that sock_sendmsg() releases all the pages in the underlying bio_vec array, but the reality is that it doesn't. svc_xprt_release() releases the rqst's response pages, but the record marker page fragment isn't one of those, so it is never released. This is a narrow fix that can be applied to stable kernels. A more extensive fix is in the works.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-20 17:12 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4 , < 1ba1291172f935e6b6fe703161a948f3347400b8 (git)
Affected: e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4 , < a2ebedf7bcd17a1194a0a18122c885eb578ee882 (git)
Affected: e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4 , < 05258a0a69b3c5d2c003f818702c0a52b6fea861 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.26 , ≤ 6.6.* (semver)
Unaffected: 6.8.5 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T17:12:02.633258Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:45.656Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.421Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1ba1291172f935e6b6fe703161a948f3347400b8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a2ebedf7bcd17a1194a0a18122c885eb578ee882"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/05258a0a69b3c5d2c003f818702c0a52b6fea861"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svcsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1ba1291172f935e6b6fe703161a948f3347400b8",
              "status": "affected",
              "version": "e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4",
              "versionType": "git"
            },
            {
              "lessThan": "a2ebedf7bcd17a1194a0a18122c885eb578ee882",
              "status": "affected",
              "version": "e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4",
              "versionType": "git"
            },
            {
              "lessThan": "05258a0a69b3c5d2c003f818702c0a52b6fea861",
              "status": "affected",
              "version": "e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svcsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix a slow server-side memory leak with RPC-over-TCP\n\nJan Schunk reports that his small NFS servers suffer from memory\nexhaustion after just a few days. A bisect shows that commit\ne18e157bb5c8 (\"SUNRPC: Send RPC message on TCP with a single\nsock_sendmsg() call\") is the first bad commit.\n\nThat commit assumed that sock_sendmsg() releases all the pages in\nthe underlying bio_vec array, but the reality is that it doesn\u0027t.\nsvc_xprt_release() releases the rqst\u0027s response pages, but the\nrecord marker page fragment isn\u0027t one of those, so it is never\nreleased.\n\nThis is a narrow fix that can be applied to stable kernels. A\nmore extensive fix is in the works."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The leak is in the server-side SUNRPC transmit path used by nfsd/lockd over TCP; it is triggered by sending an RPC to the listening socket from any remote host that can reach the service.\nAC:L - No race, timing, or memory-layout condition is involved \u2014 every RPC reply leaks the record-marker fragment deterministically, and every new TCP connection leaks a full 32 KB page.\nPR:N - svc_process_common() emits a reply (and thus allocates the leaked marker) via its err_bad_prog/err_bad_vers/err_bad_proc/err_bad_auth paths and for the NULL procedure, so no valid credentials or export membership are needed.\nUI:N - The attacker drives the entire sequence by connecting and sending RPC traffic; no action by a local user or administrator is required.\nS:U - The leaked memory and the resulting exhaustion are confined to the kernel of the NFS server itself, with no crossing of a virtualization, IOMMU, or sandbox boundary.\nC:N - The bug only fails to release a reference on a page fragment; no kernel memory contents are disclosed to the attacker and there is no out-of-bounds read.\nI:N - No memory is corrupted or overwritten \u2014 the fragment is simply never freed, so no data or control-flow integrity is affected.\nA:H - __page_frag_cache_drain() cannot free the 32 KB order-3 page because the never-released marker fragment holds the last reference, so each unauthenticated connection permanently leaks up to 32 KB; a remote attacker looping connect/send/close exhausts server memory and triggers OOM, and real deployments died of memory exhaustion under normal load."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:39.154Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1ba1291172f935e6b6fe703161a948f3347400b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2ebedf7bcd17a1194a0a18122c885eb578ee882"
        },
        {
          "url": "https://git.kernel.org/stable/c/05258a0a69b3c5d2c003f818702c0a52b6fea861"
        }
      ],
      "title": "SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35882",
    "datePublished": "2024-05-19T08:34:39.185Z",
    "dateReserved": "2024-05-17T13:50:33.112Z",
    "dateUpdated": "2026-08-05T11:30:39.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35882",
      "date": "2026-09-21",
      "epss": "0.00601",
      "percentile": "0.4716"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/svcsock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1ba1291172f935e6b6fe703161a948f3347400b8",
                    "status": "affected",
                    "version": "e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a2ebedf7bcd17a1194a0a18122c885eb578ee882",
                    "status": "affected",
                    "version": "e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "05258a0a69b3c5d2c003f818702c0a52b6fea861",
                    "status": "affected",
                    "version": "e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/svcsock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.26",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "820B6E76-73EC-4D11-9B47-9B84788379A9",
                    "versionEndExcluding": "6.6.26",
                    "versionStartIncluding": "6.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DBD6C99E-4250-4DFE-8447-FF2075939D10",
                    "versionEndExcluding": "6.8.5",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix a slow server-side memory leak with RPC-over-TCP\n\nJan Schunk reports that his small NFS servers suffer from memory\nexhaustion after just a few days. A bisect shows that commit\ne18e157bb5c8 (\"SUNRPC: Send RPC message on TCP with a single\nsock_sendmsg() call\") is the first bad commit.\n\nThat commit assumed that sock_sendmsg() releases all the pages in\nthe underlying bio_vec array, but the reality is that it doesn\u0027t.\nsvc_xprt_release() releases the rqst\u0027s response pages, but the\nrecord marker page fragment isn\u0027t one of those, so it is never\nreleased.\n\nThis is a narrow fix that can be applied to stable kernels. A\nmore extensive fix is in the works."
          },
          {
            "lang": "es",
            "value": " En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: Revertir \"drm/amd/display: Enviar mensaje de desactivaci\u00f3n DTBCLK en la primera confirmaci\u00f3n\" Esto revierte la confirmaci\u00f3n f341055b10bd8be55c3c995dff5f770b236b8ca9. Se observ\u00f3 un bloqueo del sistema; se cree que este compromiso es el punto de regresi\u00f3n."
          }
        ],
        "id": "CVE-2024-35882",
        "lastModified": "2026-08-04T11:18:05.290",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-35882",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T17:12:02.633258Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-19T09:15:09.447",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/05258a0a69b3c5d2c003f818702c0a52b6fea861"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1ba1291172f935e6b6fe703161a948f3347400b8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a2ebedf7bcd17a1194a0a18122c885eb578ee882"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/05258a0a69b3c5d2c003f818702c0a52b6fea861"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1ba1291172f935e6b6fe703161a948f3347400b8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a2ebedf7bcd17a1194a0a18122c885eb578ee882"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:58:21+00:00",
      "cve": "CVE-2024-35882",
      "id": "CVE-2024-35882",
      "initial_release_date": "2024-05-19T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35882.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T03:21:48.421Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/1ba1291172f935e6b6fe703161a948f3347400b8"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/a2ebedf7bcd17a1194a0a18122c885eb578ee882"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/05258a0a69b3c5d2c003f818702c0a52b6fea861"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-35882",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-20T17:12:02.633258Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T19:01:25.019Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/sunrpc/svcsock.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "1ba1291172f935e6b6fe703161a948f3347400b8",
                  "status": "affected",
                  "version": "e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4",
                  "versionType": "git"
                },
                {
                  "lessThan": "a2ebedf7bcd17a1194a0a18122c885eb578ee882",
                  "status": "affected",
                  "version": "e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4",
                  "versionType": "git"
                },
                {
                  "lessThan": "05258a0a69b3c5d2c003f818702c0a52b6fea861",
                  "status": "affected",
                  "version": "e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/sunrpc/svcsock.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.6"
                },
                {
                  "lessThan": "6.6",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.26",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.26",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.5",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix a slow server-side memory leak with RPC-over-TCP\n\nJan Schunk reports that his small NFS servers suffer from memory\nexhaustion after just a few days. A bisect shows that commit\ne18e157bb5c8 (\"SUNRPC: Send RPC message on TCP with a single\nsock_sendmsg() call\") is the first bad commit.\n\nThat commit assumed that sock_sendmsg() releases all the pages in\nthe underlying bio_vec array, but the reality is that it doesn\u0027t.\nsvc_xprt_release() releases the rqst\u0027s response pages, but the\nrecord marker page fragment isn\u0027t one of those, so it is never\nreleased.\n\nThis is a narrow fix that can be applied to stable kernels. A\nmore extensive fix is in the works."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The leak is in the server-side SUNRPC transmit path used by nfsd/lockd over TCP; it is triggered by sending an RPC to the listening socket from any remote host that can reach the service.\nAC:L - No race, timing, or memory-layout condition is involved \u2014 every RPC reply leaks the record-marker fragment deterministically, and every new TCP connection leaks a full 32 KB page.\nPR:N - svc_process_common() emits a reply (and thus allocates the leaked marker) via its err_bad_prog/err_bad_vers/err_bad_proc/err_bad_auth paths and for the NULL procedure, so no valid credentials or export membership are needed.\nUI:N - The attacker drives the entire sequence by connecting and sending RPC traffic; no action by a local user or administrator is required.\nS:U - The leaked memory and the resulting exhaustion are confined to the kernel of the NFS server itself, with no crossing of a virtualization, IOMMU, or sandbox boundary.\nC:N - The bug only fails to release a reference on a page fragment; no kernel memory contents are disclosed to the attacker and there is no out-of-bounds read.\nI:N - No memory is corrupted or overwritten \u2014 the fragment is simply never freed, so no data or control-flow integrity is affected.\nA:H - __page_frag_cache_drain() cannot free the 32 KB order-3 page because the never-released marker fragment holds the last reference, so each unauthenticated connection permanently leaks up to 32 KB; a remote attacker looping connect/send/close exhausts server memory and triggers OOM, and real deployments died of memory exhaustion under normal load."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:30:39.154Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/1ba1291172f935e6b6fe703161a948f3347400b8"
            },
            {
              "url": "https://git.kernel.org/stable/c/a2ebedf7bcd17a1194a0a18122c885eb578ee882"
            },
            {
              "url": "https://git.kernel.org/stable/c/05258a0a69b3c5d2c003f818702c0a52b6fea861"
            }
          ],
          "title": "SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-35882",
        "datePublished": "2024-05-19T08:34:39.185Z",
        "dateReserved": "2024-05-17T13:50:33.112Z",
        "dateUpdated": "2026-08-05T11:30:39.154Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.