CVE-2026-72491

Received Received - Intake

Race Condition in Linux Kernel 9P RDMA Transport

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma->state in trans_rdma.c The rdma->state field is modified without holding req_lock in both recv_done() and p9_cm_event_handler(), while rdma_request() accesses the same field under the req_lock spinlock. This inconsistent locking creates a race condition: - recv_done() running in softirq completion context sets rdma->state = P9_RDMA_FLUSHING without acquiring req_lock - p9_cm_event_handler() modifies rdma->state at multiple points (ADDR_RESOLVED, ROUTE_RESOLVED, ESTABLISHED, CLOSED) without req_lock - rdma_request() uses spin_lock_irqsave(&rdma->req_lock, flags) to protect the read-modify-write of rdma->state The race can cause lost state transitions: recv_done() or the CM event handler could set state to FLUSHING/CLOSED while rdma_request() is concurrently checking or modifying state under the lock, leading to the FLUSHING transition being silently overwritten by CLOSING. This corrupts the connection state machine and can cause use-after-free on RDMA request objects during teardown. Fix by adding req_lock protection to all rdma->state modifications in recv_done() and p9_cm_event_handler(), matching the pattern already used in rdma_request(). Use spin_lock_irqsave/spin_unlock_irqrestore in the CM event handler since it can race with recv_done() which runs in softirq context. Tested with a kernel module that races two threads (simulating rdma_request and recv_done/CM handler) on rdma->state with proper locking: 5.5M+ FLUSHING writes over 27M iterations with 0 lost transitions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72491

EUVD

EUVD-2026-59390

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a race condition in the Linux kernel's 9P network filesystem RDMA transport code. The vulnerability occurs because the rdma->state field is modified without proper locking in two functions (recv_done and p9_cm_event_handler), while another function (rdma_request) accesses it under a lock. This inconsistent locking can cause state transitions to be lost, corrupting the connection state machine and potentially leading to use-after-free errors during teardown.

Detection Guidance

This vulnerability is specific to the Linux kernel's 9P RDMA implementation and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the presence of the vulnerable code path. Commands like dmesg or journalctl may show kernel errors, but direct detection requires kernel source code analysis or runtime tracing tools like ftrace or perf.

Impact Analysis

This vulnerability could cause system crashes or data corruption in systems using the 9P filesystem with RDMA transport. It may lead to use-after-free errors during connection teardown, which could be exploited to execute arbitrary code or cause denial of service. Systems not using 9P with RDMA are unaffected.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a race condition in the Linux kernel's 9P network filesystem RDMA transport layer that could lead to connection state corruption and use-after-free errors. Compliance impacts would only occur if this vulnerability were exploited to cause data integrity issues or unauthorized access in systems handling regulated data.

Mitigation Strategies

Apply the kernel patch that fixes the race condition in trans_rdma.c. Update to a kernel version that includes the fix. If immediate patching is not possible, disable the 9P RDMA protocol (CONFIG_9P_RDMA) to prevent exploitation until the patch is applied.

Hi! I’m here to help you understand CVE-2026-72491. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70