CVE-2026-72220

Received Received - Intake

Double-Free in Linux Kernel SunRPC

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sunrpc: harden rq_procinfo lifecycle to prevent double-free The svc_release_rqst() function executes the callback inside rqstp->rq_procinfo->pc_release. However, if a worker thread begins processing a new request and encounters an early error path (e.g., unsupported protocol, short frame, or bad auth) before a valid rq_procinfo is installed, a stale release hook can be re-triggered against reused state from the previous RPC, resulting in a double-free or use-after-free vulnerability. Harden the lifecycle of rq_procinfo by: 1. Ensuring svc_release_rqst() always clears rq_procinfo after the optional pc_release() call, regardless of whether the hook exists. 2. Explicitly clearing rq_procinfo at request entry in svc_process() before any early decode or drop paths. 3. Ensuring svc_process_bc() does the same at backchannel entry. This guarantees that error flows will not encounter a non-NULL stale rq_procinfo pointer when there is nothing to release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72220

EUVD

EUVD-2026-59119

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a double-free or use-after-free vulnerability in the Linux kernel's sunrpc subsystem. It occurs when a worker thread processes a new request and encounters an error before setting up a valid rq_procinfo structure. A stale release hook from a previous RPC request can then be triggered against reused state, causing memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's sunrpc module and requires kernel-level inspection. Detection involves checking kernel logs for RPC-related errors or crashes, particularly during RPC request processing. Use commands like dmesg | grep -i rpc or journalctl -k | grep -i rpc to search for related errors. Kernel patch verification with uname -r or checking installed kernel versions against patched versions may also help.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system or potentially execute arbitrary code with kernel privileges. It affects systems using the sunrpc subsystem for remote procedure calls.

Compliance Impact

This vulnerability is a memory corruption issue in the Linux kernel's RPC subsystem that could lead to double-free or use-after-free conditions. It does not directly relate to data privacy or security controls required by GDPR or HIPAA, as it affects low-level kernel memory management rather than data handling or access controls.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the double-free vulnerability in the sunrpc component.

Hi! I’m here to help you understand CVE-2026-72220. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70