CVE-2026-72469
Received Received - Intake

Use-After-Free in Linux Kernel xprtrdma Module

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE rpcrdma_cm_event_handler() falls through to the disconnected: label on RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no matching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED. The kref then underflows during connect teardown and rpcrdma_xprt_disconnect() operates on a freed ep. Reference counts across a normal connection lifecycle: rpcrdma_ep_create() kref_init ->1 rpcrdma_xprt_connect() ep_get ->2 (before post_recvs) RDMA_CM_EVENT_ESTABLISHED ep_get ->3 RDMA_CM_EVENT_DISCONNECTED ep_put ->2 rpcrdma_xprt_drain() ep_put ->1 rpcrdma_xprt_disconnect() tail ep_put ->0 (ep_destroy) The connect-time get in rpcrdma_xprt_connect(), taken just before rpcrdma_post_recvs() "while there are outstanding Receives," is balanced by rpcrdma_xprt_drain. ADDR_CHANGE before ESTABLISHED has no get to consume, so its put drops the count to 1 and the drain put then frees the ep while rpcrdma_xprt_disconnect() still holds a pointer to it. Fix by dispatching on the prior re_connect_status via xchg(): for prev == 0 (pre-ESTABLISHED) wake the connect waiter and return with no put; for prev == 1 call rpcrdma_force_disconnect() and return. The case-1 arm relies on the subsequent RDMA_CM_EVENT_DISCONNECTED event -- reliably delivered when rdma_disconnect() is called on a still-connected cm_id -- to balance the ESTABLISHED get; rpcrdma_xprt_drain() continues to balance only that connect-time get. Any other prior value means teardown is already in flight.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72469
EUVD
EUVD-2026-59368

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a reference count imbalance in the xprtrdma component. When an RDMA_CM_EVENT_ADDR_CHANGE event occurs before RDMA_CM_EVENT_ESTABLISHED, the reference count (kref) for the endpoint (ep) underflows during connection teardown. This happens because rpcrdma_cm_event_handler() calls rpcrdma_ep_put() without a prior matching rpcrdma_ep_get(), leading to a freed endpoint being accessed by rpcrdma_xprt_disconnect().

Detection Guidance

This vulnerability is specific to the Linux kernel's xprtrdma module and requires kernel-level inspection. Detection involves checking kernel logs for RDMA_CM_EVENT_ADDR_CHANGE events or kref underflow warnings. Use commands like 'dmesg | grep -i xprtrdma' or 'journalctl -k | grep -i rpcrdma' to search for related errors.

Impact Analysis

This vulnerability could cause system instability or crashes due to memory corruption or use-after-free errors. It may lead to denial-of-service conditions if the kernel panics or terminates processes abnormally. Systems relying on RDMA (Remote Direct Memory Access) for high-performance networking could experience disruptions.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this issue. If immediate patching is not possible, disable the xprtrdma module by unloading the rpcrdma module with 'modprobe -r rpcrdma' until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72469. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart