CVE-2026-72465

Received Received - Intake

xprtrdma Reply Credit Grant Sanitization Flaw

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The out_norqst exit in rpcrdma_reply_handler() branches away before the credit clamp, so a reply that matches no pending request reaches out_post carrying the raw credit value parsed from the wire. rpcrdma_post_recvs() does not bound its @needed argument: the refill loop allocates and chains Receive WRs until the count is satisfied or allocation fails. A peer that sends a well-formed reply carrying an unknown XID and an inflated credit grant therefore drives rep allocation and Receive posting past re_max_requests on every such reply. Move the clamp to immediately after the credit field is parsed, ahead of the first branch that can reach out_post, so every later consumer sees a sanitized value. The cwnd update stays on the matched-request path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72465

EUVD

EUVD-2026-59364

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of reply credits in the xprtrdma component. A malicious peer can send a reply with an unknown request ID and an inflated credit grant, causing excessive resource allocation. The fix moves credit sanitization earlier to prevent this issue.

Detection Guidance

This vulnerability involves the Linux kernel's xprtrdma module handling reply credit grants improperly. Detection requires checking kernel logs for rpcrdma-related errors or monitoring network traffic for malformed RPC replies with inflated credit values. Use commands like dmesg | grep rpcrdma or journalctl -k | grep rpcrdma to inspect kernel logs for suspicious activity.

Impact Analysis

An attacker could exploit this to cause denial-of-service by consuming excessive system resources, leading to degraded performance or crashes. Systems using RPC over RDMA may be affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel networking issue involving reply credit handling in the xprtrdma module. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability. Monitor network traffic for unusual patterns that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-72465. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70