CVE-2026-72468

Received Received - Intake

Use-After-Free in Linux Kernel xprtrdma

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re_id before removal registration rpcrdma_create_id() registers ep->re_rn with the rpcrdma ib_client before returning the new rdma_cm_id to rpcrdma_ep_create(). However rpcrdma_ep_create() currently stores that pointer in ep->re_id only after rpcrdma_create_id() returns. A local administrator can race an NFS/RDMA mount against RDMA device removal. If rpcrdma_remove_one() observes the just-registered notification before rpcrdma_ep_create() assigns ep->re_id, rpcrdma_ep_removal_done() calls trace_xprtrdma_device_removal(NULL). The tracepoint dereferences id->device->name and copies id->route.addr.dst_addr, so the callback can crash the kernel with a NULL pointer dereference. Store the rdma_cm_id in ep->re_id immediately before publishing ep->re_rn. The existing error path still destroys the id directly if registration fails; ep is then freed by the caller without using ep->re_id. Remove the later duplicate assignment in rpcrdma_ep_create().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72468

EUVD

EUVD-2026-59367

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the Linux kernel's NFS/RDMA (Network File System over Remote Direct Memory Access) implementation. It occurs when an administrator attempts to remove an RDMA device while an NFS/RDMA mount is in progress. The issue arises because the rdma_cm_id is registered before being stored in the correct location, leading to a NULL pointer dereference if the device removal happens prematurely.

Detection Guidance

This vulnerability is specific to the Linux kernel's xprtrdma module and involves a race condition during RDMA device removal. Detection requires checking kernel logs for NULL pointer dereference errors related to rpcrdma or xprtrdma. Monitor logs with commands like dmesg | grep -i 'xprtrdma\|rpcrdma\|NULL pointer' or journalctl -k | grep -i 'xprtrdma\|rpcrdma\|NULL pointer'.

Impact Analysis

This vulnerability can crash the Linux kernel if exploited by a local administrator. A successful attack could lead to a denial-of-service condition, causing system instability or requiring a reboot to restore normal operation.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a local kernel crash issue in the Linux NFS/RDMA subsystem. It does not involve data exposure or unauthorized access that would typically impact these regulations.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. If patching is not immediately possible, avoid using NFS over RDMA mounts or unbind RDMA devices while mounts are active. Monitor kernel logs for related crashes and consider disabling RDMA if not critical to operations.

Hi! I’m here to help you understand CVE-2026-72468. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70