CVE-2026-72465

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72465", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.933Z", "datePublished": "2026-08-15T05:57:08.767Z", "dateUpdated": "2026-08-17T05:44:31.793Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:44:31.793Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Sanitize the reply credit grant after parsing\n\nThe out_norqst exit in rpcrdma_reply_handler() branches away before\nthe credit clamp, so a reply that matches no pending request reaches\nout_post carrying the raw credit value parsed from the wire.\nrpcrdma_post_recvs() does not bound its @needed argument: the refill\nloop allocates and chains Receive WRs until the count is satisfied or\nallocation fails. A peer that sends a well-formed reply carrying an\nunknown XID and an inflated credit grant therefore drives rep\nallocation and Receive posting past re_max_requests on every such\nreply.\n\nMove the clamp to immediately after the credit field is parsed,\nahead of the first branch that can reach out_post, so every later\nconsumer sees a sanitized value. The cwnd update stays on the\nmatched-request path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The flaw is in the NFS-over-RDMA client receive path: rpcrdma_wc_receive() delivers remote RDMA reply completions to rpcrdma_reply_handler(), so a malicious or compromised NFS/RDMA server can send crafted replies over InfiniBand/RoCE/iWARP without local access.\nAC:L - On an established RPC/RDMA session the peer fully controls inbound replies and can reliably send well-formed headers with an unknown XID and an inflated credit grant on every message, deterministically reaching out_norqst and out_post without races or special victim state.\nPR:N - Exploitation requires only network reachability as the connected RDMA/RPC peer; the attacker does not need local accounts, mount privileges, or namespaced capabilities on the victim NFS client to deliver malicious reply traffic.\nUI:N - Once an NFS-over-RDMA mount and transport session exist, the attacker can flood spurious replies during normal client-server communication without any additional victim or administrator action at exploit time.\nS:U - Impact is confined to excessive kernel memory allocation and denial of service within the NFS client's SUNRPC/xprtrdma transport; it does not cross VM, container, or IOMMU security boundaries.\nC:N - The bug is unbounded receive-buffer allocation driven by an unsanitized wire credit field, not an out-of-bounds read, use-after-free, or other memory disclosure primitive that exposes kernel data to the attacker.\nI:N - Inflated credits only cause rpcrdma_post_recvs() to allocate and post extra rpcrdma_rep objects; there is no demonstrated memory corruption, arbitrary write, or control-flow hijack primitive.\nA:H - Each spurious reply can drive rpcrdma_rep_create() far past re_max_requests until allocation fails, enabling repeated remote kernel memory exhaustion, OOM conditions, and loss of NFS-over-RDMA service on the client."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/xprtrdma/rpc_rdma.c"], "versions": [{"version": "d01d6670c169316115b26dfb3585a73dfe40b563", "lessThan": "7cf332b3d82d73ffceedca6b4a120be074172021", "status": "affected", "versionType": "git"}, {"version": "d1b159356a3584943192712392fcb2439aafb8c1", "lessThan": "41634242140173eabbf54f899f9c70b5c685e786", "status": "affected", "versionType": "git"}, {"version": "17da9e0caa8615f6fc3b4022eadbd78a9aea1a2a", "lessThan": "8be1bb378def94a5cb8f7527a191e476407118ec", "status": "affected", "versionType": "git"}, {"version": "e7ae0883c8c89b901226de43862184bf37054338", "lessThan": "469b22376ee73369711ecf2761bd122ef4195963", "status": "affected", "versionType": "git"}, {"version": "704f3f640f72db4d44ec5ce3db8d4e150c974bc7", "lessThan": "33db78b1b24fc6a464ae08aa4d2538c5f883eb5e", "status": "affected", "versionType": "git"}, {"version": "704f3f640f72db4d44ec5ce3db8d4e150c974bc7", "lessThan": "c3a628aab2dc8f5fd7bff86ceaeae64de590e60a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/xprtrdma/rpc_rdma.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7cf332b3d82d73ffceedca6b4a120be074172021"}, {"url": "https://git.kernel.org/stable/c/41634242140173eabbf54f899f9c70b5c685e786"}, {"url": "https://git.kernel.org/stable/c/8be1bb378def94a5cb8f7527a191e476407118ec"}, {"url": "https://git.kernel.org/stable/c/469b22376ee73369711ecf2761bd122ef4195963"}, {"url": "https://git.kernel.org/stable/c/33db78b1b24fc6a464ae08aa4d2538c5f883eb5e"}, {"url": "https://git.kernel.org/stable/c/c3a628aab2dc8f5fd7bff86ceaeae64de590e60a"}], "title": "xprtrdma: Sanitize the reply credit grant after parsing", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sunrpc/xprtrdma/rpc_rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7cf332b3d82d73ffceedca6b4a120be074172021", "status": "affected", "version": "d01d6670c169316115b26dfb3585a73dfe40b563", "versionType": "git"}, {"lessThan": "41634242140173eabbf54f899f9c70b5c685e786", "status": "affected", "version": "d1b159356a3584943192712392fcb2439aafb8c1", "versionType": "git"}, {"lessThan": "8be1bb378def94a5cb8f7527a191e476407118ec", "status": "affected", "version": "17da9e0caa8615f6fc3b4022eadbd78a9aea1a2a", "versionType": "git"}, {"lessThan": "469b22376ee73369711ecf2761bd122ef4195963", "status": "affected", "version": "e7ae0883c8c89b901226de43862184bf37054338", "versionType": "git"}, {"lessThan": "33db78b1b24fc6a464ae08aa4d2538c5f883eb5e", "status": "affected", "version": "704f3f640f72db4d44ec5ce3db8d4e150c974bc7", "versionType": "git"}, {"lessThan": "c3a628aab2dc8f5fd7bff86ceaeae64de590e60a", "status": "affected", "version": "704f3f640f72db4d44ec5ce3db8d4e150c974bc7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sunrpc/xprtrdma/rpc_rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Sanitize the reply credit grant after parsing\n\nThe out_norqst exit in rpcrdma_reply_handler() branches away before\nthe credit clamp, so a reply that matches no pending request reaches\nout_post carrying the raw credit value parsed from the wire.\nrpcrdma_post_recvs() does not bound its @needed argument: the refill\nloop allocates and chains Receive WRs until the count is satisfied or\nallocation fails. A peer that sends a well-formed reply carrying an\nunknown XID and an inflated credit grant therefore drives rep\nallocation and Receive posting past re_max_requests on every such\nreply.\n\nMove the clamp to immediately after the credit field is parsed,\nahead of the first branch that can reach out_post, so every later\nconsumer sees a sanitized value. The cwnd update stays on the\nmatched-request path."}], "id": "CVE-2026-72465", "lastModified": "2026-08-17T06:19:14.310", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:20.527", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/33db78b1b24fc6a464ae08aa4d2538c5f883eb5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/41634242140173eabbf54f899f9c70b5c685e786"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/469b22376ee73369711ecf2761bd122ef4195963"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7cf332b3d82d73ffceedca6b4a120be074172021"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8be1bb378def94a5cb8f7527a191e476407118ec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3a628aab2dc8f5fd7bff86ceaeae64de590e60a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: xprtrdma: Sanitize the reply credit grant after parsing", "id": "2516663", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516663"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxprtrdma: Sanitize the reply credit grant after parsing\nThe out_norqst exit in rpcrdma_reply_handler() branches away before\nthe credit clamp, so a reply that matches no pending request reaches\nout_post carrying the raw credit value parsed from the wire.\nrpcrdma_post_recvs() does not bound its @needed argument: the refill\nloop allocates and chains Receive WRs until the count is satisfied or\nallocation fails. A peer that sends a well-formed reply carrying an\nunknown XID and an inflated credit grant therefore drives rep\nallocation and Receive posting past re_max_requests on every such\nreply.\nMove the clamp to immediately after the credit field is parsed,\nahead of the first branch that can reach out_post, so every later\nconsumer sees a sanitized value. The cwnd update stays on the\nmatched-request path.", "A flaw was found in the Linux kernel's `xprtrdma` component. A remote attacker can exploit this by sending specially crafted RPC over RDMA replies containing an inflated credit grant. This vulnerability can lead to excessive allocation of Receive Work Requests, potentially causing a Denial of Service (DoS) due to resource exhaustion and system instability."], "name": "CVE-2026-72465", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72465\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72465\nhttps://lore.kernel.org/linux-cve-announce/2026081534-CVE-2026-72465-1064@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d01d6670c169316115b26dfb3585a73dfe40b563,7cf332b3d82d73ffceedca6b4a120be074172021)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d1b159356a3584943192712392fcb2439aafb8c1,41634242140173eabbf54f899f9c70b5c685e786)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[17da9e0caa8615f6fc3b4022eadbd78a9aea1a2a,8be1bb378def94a5cb8f7527a191e476407118ec)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e7ae0883c8c89b901226de43862184bf37054338,469b22376ee73369711ecf2761bd122ef4195963)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[704f3f640f72db4d44ec5ce3db8d4e150c974bc7,33db78b1b24fc6a464ae08aa4d2538c5f883eb5e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[704f3f640f72db4d44ec5ce3db8d4e150c974bc7,c3a628aab2dc8f5fd7bff86ceaeae64de590e60a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,8.0.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T17:45:03.069966+00:00", "updated": "2026-08-22T04:45:03.427585+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}