« Volver al listado

CVE-2026-72467

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: Check frwr_wp_create() during connect

frwr_wp_create() creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave ep->re_write_pad_mr set to NULL.

rpcrdma_xprt_connect() currently ignores that return value. If frwr_wp_create() fails after the rest of the connection setup succeeds, xprt_rdma_connect_worker() treats the connection attempt as successful and sets XPRT_CONNECTED. A later NFS/RDMA read with a non-4-byte-aligned receive page length reaches rpcrdma_encode_write_list(), passes the NULL write-pad MR to encode_rdma_segment(), and dereferences it.

Leer descripción completaMostrar menos

This is locally triggerable on an NFS/RDMA client after a connect or reconnect hits a local MR allocation, DMA-map, MR-map, or post-send failure; a remote peer alone cannot force the local MR setup failure.

Check the return value and fail the connect as -ENOTCONN, matching the adjacent setup failures. This keeps XPRT_CONNECTED clear and lets the normal reconnect path retry.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72467",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "21037b8c2258ec40de3b31be9ced43ceb3b784f7",
              "lessThan": "3b252fe1778b2cdd68283146455929801bc2abd7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "21037b8c2258ec40de3b31be9ced43ceb3b784f7",
              "lessThan": "dd798b76a3481e392820c3ae86ed4592858c6b0f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "21037b8c2258ec40de3b31be9ced43ceb3b784f7",
              "lessThan": "6b7be4f3feae322f1c2c40a3bdc99db93574a49e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "21037b8c2258ec40de3b31be9ced43ceb3b784f7",
              "lessThan": "7471e66373a4444a57ef2192f8c4081202c54f45",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "21037b8c2258ec40de3b31be9ced43ceb3b784f7",
              "lessThan": "ef3b79edf14b6bfb0d21a26ccb0463f9cf82c6a9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "21037b8c2258ec40de3b31be9ced43ceb3b784f7",
              "lessThan": "0f13fc7c7d2e0427517e63c739277a4cd338b0c5",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/sunrpc/xprtrdma/verbs.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/sunrpc/xprtrdma/verbs.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:22:20.770",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0f13fc7c7d2e0427517e63c739277a4cd338b0c5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3b252fe1778b2cdd68283146455929801bc2abd7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6b7be4f3feae322f1c2c40a3bdc99db93574a49e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7471e66373a4444a57ef2192f8c4081202c54f45",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dd798b76a3481e392820c3ae86ed4592858c6b0f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ef3b79edf14b6bfb0d21a26ccb0463f9cf82c6a9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Check frwr_wp_create() during connect\n\nfrwr_wp_create() creates the singleton Memory Region used to encode\npadding for Write chunks whose payload length is not XDR-aligned. Its\nfailure paths return a negative errno and leave ep->re_write_pad_mr set\nto NULL.\n\nrpcrdma_xprt_connect() currently ignores that return value. If\nfrwr_wp_create() fails after the rest of the connection setup succeeds,\nxprt_rdma_connect_worker() treats the connection attempt as successful\nand sets XPRT_CONNECTED. A later NFS/RDMA read with a non-4-byte-aligned\nreceive page length reaches rpcrdma_encode_write_list(), passes the NULL\nwrite-pad MR to encode_rdma_segment(), and dereferences it.\n\nThis is locally triggerable on an NFS/RDMA client after a connect or\nreconnect hits a local MR allocation, DMA-map, MR-map, or post-send\nfailure; a remote peer alone cannot force the local MR setup failure.\n\nCheck the return value and fail the connect as -ENOTCONN, matching the\nadjacent setup failures. This keeps XPRT_CONNECTED clear and lets the\nnormal reconnect path retry."
    }
  ],
  "lastModified": "2026-08-17T06:19:14.580",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}