CVE-2026-72467

Received Received - Intake

Memory Region Allocation Failure in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwr_wp_create() during connect frwr_wp_create() creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave ep->re_write_pad_mr set to NULL. rpcrdma_xprt_connect() currently ignores that return value. If frwr_wp_create() fails after the rest of the connection setup succeeds, xprt_rdma_connect_worker() treats the connection attempt as successful and sets XPRT_CONNECTED. A later NFS/RDMA read with a non-4-byte-aligned receive page length reaches rpcrdma_encode_write_list(), passes the NULL write-pad MR to encode_rdma_segment(), and dereferences it. This is locally triggerable on an NFS/RDMA client after a connect or reconnect hits a local MR allocation, DMA-map, MR-map, or post-send failure; a remote peer alone cannot force the local MR setup failure. Check the return value and fail the connect as -ENOTCONN, matching the adjacent setup failures. This keeps XPRT_CONNECTED clear and lets the normal reconnect path retry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72467

EUVD

EUVD-2026-59366

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's xprtrdma module, which handles NFS over RDMA connections. The issue occurs when frwr_wp_create() fails during connection setup but the failure is ignored. This can lead to a NULL pointer dereference later when processing non-aligned read requests, causing a system crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS/RDMA client implementation and may not have direct detection commands. Monitor kernel logs for NFS/RDMA connection failures or crashes, particularly after memory allocation or DMA mapping issues. Check for errors in dmesg or journalctl logs related to rpcrdma or xprtrdma modules.

Impact Analysis

If exploited, this vulnerability could cause a denial of service by crashing the system. It requires local access to trigger, meaning an attacker would need existing access to the machine to exploit it. Normal operations like file reads over NFS/RDMA could fail if the system crashes.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a local kernel-level issue in the Linux NFS/RDMA client. It may indirectly impact compliance if the vulnerability leads to data integrity issues or service disruptions in systems handling regulated data.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If using NFS/RDMA, consider temporarily disabling it if patches are unavailable. Monitor vendor advisories for updates and test patches in a non-production environment before deployment.

Hi! I’m here to help you understand CVE-2026-72467. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70