Hi Dave, Trond et al, I'd been seeing occasional false positives from rkhunter's hidden tcp port check every couple of days while running 4.9.130 (via the Debian kernel packages), see https://bugs.debian.org/917533 for more background.
I found the solution was 9b30889c548a ("SUNRPC: Ensure we always close the socket after a connection shuts down"). Would it be possible to get that sent to the stable trees please? FYI to get a clean/successful cherry-pick I found I needed to take all of: 8d1b8c62e080 SUNRPC: Refactor TCP socket timeout code into a helper function 3ffbc1d65583 net/sunrpc/xprt_sock: fix regression in connection error reporting. 9b30889c548a SUNRPC: Ensure we always close the socket after a connection shuts down I've been running that for a week with no leaks so far. I'm not sure what stable/LTS kernels other than 4.9 are affected. Thanks, Ian.