CVE-2026-72473

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72473", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.934Z", "datePublished": "2026-08-15T05:57:14.412Z", "dateUpdated": "2026-10-16T18:55:25.751Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:44:39.513Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Decouple req recycling from RPC completion\n\nrl_kref formerly served two distinct lifetimes through a single\nrefcount: it gated when a Reply could wake its RPC task, and it\ngated when an rpcrdma_req could return to its free pool. The\nmarshal path took the Send-side reference only when SGEs needed\nDMA-unmap (sc_unmap_count > 0), which made a Send carrying only\npre-registered buffers an exception: the Reply handler dropped\nrl_kref from 1 to 0 and freed the req while the HCA might still\nbe DMA-reading from its send buffer.\n\nGive rl_kref a narrower job. The RPC layer takes one reference\nwhen slot allocation hands a req out. rpcrdma_prepare_send_sges()\ntakes a Send-side reference unconditionally after WR preparation\nsucceeds. xprt_rdma_free_slot() and xprt_rdma_bc_free_rqst() drop\nthe RPC-layer reference; rpcrdma_sendctx_unmap() drops the\nSend-side reference. The req returns to its free pool only after\nboth owners have signed off.\n\nThe existing kref_init(&req->rl_kref) call in\nrpcrdma_prepare_send_sges() is removed. Initialization moves to\nthe slot-allocation paths (xprt_rdma_alloc_slot and\nrpcrdma_bc_rqst_get), and the release callback re-arms rl_kref\nbefore the req returns to a free pool. A re-init in the marshal\npath would discard the RPC-layer reference that already exists\non entry.\n\nThree invariants follow:\n\n - Any rpcrdma_req held by an rpc_rqst has rl_kref >= 1.\n xprt_rdma_alloc_slot(), rpcrdma_bc_rqst_get(), and the\n backlog-wake branch in xprt_rdma_alloc_slot() each kref_init\n rl_kref before publishing the req. Without this invariant,\n an RPC task that aborts between slot allocation and marshal\n (gss_refresh failure or signal during call_connect, for\n example) would drive xprt_release() ->\n xprt_rdma_free_slot() -> kref_put against a refcount of\n zero, saturating refcount_t and stranding the slot.\n\n - The Send-side reference is taken only after WR prep\n succeeds. A mapping failure in rpcrdma_prepare_send_sges()\n runs rpcrdma_sendctx_cancel(), which DMA-unmaps the sendctx\n and clears sc_req without touching rl_kref. The sendctx\n ring walks in rpcrdma_sendctx_put_locked() and\n rpcrdma_sendctxs_destroy() skip entries with sc_req == NULL,\n so a burst of -EIO marshal failures cannot hold reqs off\n rb_send_bufs.\n\n - The release callback re-arms rl_kref so the next consumer\n enters with the invariant satisfied.\n\nReplies now complete the RPC directly. rpcrdma_reply_handler()\ncalls rpcrdma_complete_rqst() in place of kref_put on the\nnon-LocalInv branch. The LocalInv branch already completes the\nRPC from frwr_unmap_async() and is unaffected.\n\nBecause Send-side references can now outlive RPC completion,\nconnection teardown drains sendctx entries whose unsignaled\nSends never had a later signaled completion to walk the ring.\nrpcrdma_sendctxs_destroy() walks the active range and runs\nrpcrdma_sendctx_unmap() on each entry with a non-NULL sc_req\nbefore the request buffers are reset, and is moved ahead of\nrpcrdma_reqs_reset() in rpcrdma_xprt_disconnect() so the reqs\nare still in their pre-reset state when the Send-side refs are\nreleased.\n\nThe drain creates a teardown-ordering hazard on the backchannel\npath. With the new lifetime, releasing a bc_prealloc req from\nrpcrdma_req_release() re-adds it to bc_pa_list. The disconnect\nin xprt_rdma_destroy() runs after xprt_destroy_backchannel() has\nalready emptied bc_pa_list, so the drained reqs would otherwise\nleak. xprt_rdma_destroy() now runs xprt_rdma_bc_destroy(xprt, 0)\na second time after the disconnect to reclaim them."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in the RPC-over-RDMA client (xprtrdma); a remote NFS/RDMA peer delivers Receive completions that invoke rpcrdma_reply_handler() over InfiniBand/RoCE/iWARP, so exploitation is via network protocol traffic from a malicious or compromised server.\nAC:L - For inline Sends using only pre-registered buffers (sc_unmap_count==0), the reply path completes the RPC and returns the req to the free pool before Send completion; a remote peer can reliably trigger this by replying immediately to normal small NFS RPCs.\nPR:N - Exploitation requires no privileges on the victim host; a remote malicious or compromised NFS/RDMA server can send crafted/fast replies over the established RDMA connection to drive the vulnerable completion path.\nUI:N - No end-user interaction is needed at exploit time; once a host uses NFS-over-RDMA, triggering the bug is automatic during ordinary client I/O against the attacker-controlled server.\nS:U - The flaw causes kernel heap UAF/DMA corruption within the NFS client's kernel context and does not by itself cross hypervisor, VM, or sandbox security boundaries.\nC:H - Recycling rpcrdma_req while the HCA may still DMA-read its send buffers is a use-after-free that can expose or leak kernel memory when the slot is reallocated and buffers are reused under active DMA.\nI:H - Premature return of rpcrdma_req to rb_send_bufs while Send WRs are in flight permits heap corruption and typical UAF exploitation paths for arbitrary kernel memory writes or control-flow hijack.\nA:H - Concurrent DMA against freed/reused request buffers can provoke kernel oops/panic or wedged RPC/RDMA transport state, giving high availability impact on NFS-over-RDMA clients."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/xprtrdma/backchannel.c", "net/sunrpc/xprtrdma/rpc_rdma.c", "net/sunrpc/xprtrdma/transport.c", "net/sunrpc/xprtrdma/verbs.c", "net/sunrpc/xprtrdma/xprt_rdma.h"], "versions": [{"version": "0ab115237025f5e379620bbcd56a02697d07b002", "lessThan": "740975054a1970c0cf15f70ac39724a064f45847", "status": "affected", "versionType": "git"}, {"version": "0ab115237025f5e379620bbcd56a02697d07b002", "lessThan": "9f3d9b68c1c6c51746e5ecdb52b2e6a2901de37e", "status": "affected", "versionType": "git"}, {"version": "0ab115237025f5e379620bbcd56a02697d07b002", "lessThan": "e7632089523acddcdd8f090ad19e96fb3107b04d", "status": "affected", "versionType": "git"}, {"version": "0ab115237025f5e379620bbcd56a02697d07b002", "lessThan": "53442c7d0c888e51b8bc3da196970a669cc6b294", "status": "affected", "versionType": "git"}, {"version": "0ab115237025f5e379620bbcd56a02697d07b002", "lessThan": "8203f760a72bd39a3b66bc4eff0aa272a99fe22b", "status": "affected", "versionType": "git"}, {"version": "0ab115237025f5e379620bbcd56a02697d07b002", "lessThan": "e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/xprtrdma/backchannel.c", "net/sunrpc/xprtrdma/rpc_rdma.c", "net/sunrpc/xprtrdma/transport.c", "net/sunrpc/xprtrdma/verbs.c", "net/sunrpc/xprtrdma/xprt_rdma.h"], "versions": [{"version": "5.3", "status": "affected"}, {"version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/740975054a1970c0cf15f70ac39724a064f45847"}, {"url": "https://git.kernel.org/stable/c/9f3d9b68c1c6c51746e5ecdb52b2e6a2901de37e"}, {"url": "https://git.kernel.org/stable/c/e7632089523acddcdd8f090ad19e96fb3107b04d"}, {"url": "https://git.kernel.org/stable/c/53442c7d0c888e51b8bc3da196970a669cc6b294"}, {"url": "https://git.kernel.org/stable/c/8203f760a72bd39a3b66bc4eff0aa272a99fe22b"}, {"url": "https://git.kernel.org/stable/c/e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3"}], "title": "xprtrdma: Decouple req recycling from RPC completion", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72473", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:50:33.438850Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:25.751Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72473", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:50:33.438850Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:50:34.027Z"}}], "cna": {"title": "xprtrdma: Decouple req recycling from RPC completion", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in the RPC-over-RDMA client (xprtrdma); a remote NFS/RDMA peer delivers Receive completions that invoke rpcrdma_reply_handler() over InfiniBand/RoCE/iWARP, so exploitation is via network protocol traffic from a malicious or compromised server.\nAC:L - For inline Sends using only pre-registered buffers (sc_unmap_count==0), the reply path completes the RPC and returns the req to the free pool before Send completion; a remote peer can reliably trigger this by replying immediately to normal small NFS RPCs.\nPR:N - Exploitation requires no privileges on the victim host; a remote malicious or compromised NFS/RDMA server can send crafted/fast replies over the established RDMA connection to drive the vulnerable completion path.\nUI:N - No end-user interaction is needed at exploit time; once a host uses NFS-over-RDMA, triggering the bug is automatic during ordinary client I/O against the attacker-controlled server.\nS:U - The flaw causes kernel heap UAF/DMA corruption within the NFS client's kernel context and does not by itself cross hypervisor, VM, or sandbox security boundaries.\nC:H - Recycling rpcrdma_req while the HCA may still DMA-read its send buffers is a use-after-free that can expose or leak kernel memory when the slot is reallocated and buffers are reused under active DMA.\nI:H - Premature return of rpcrdma_req to rb_send_bufs while Send WRs are in flight permits heap corruption and typical UAF exploitation paths for arbitrary kernel memory writes or control-flow hijack.\nA:H - Concurrent DMA against freed/reused request buffers can provoke kernel oops/panic or wedged RPC/RDMA transport state, giving high availability impact on NFS-over-RDMA clients."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0ab115237025f5e379620bbcd56a02697d07b002", "lessThan": "740975054a1970c0cf15f70ac39724a064f45847", "versionType": "git"}, {"status": "affected", "version": "0ab115237025f5e379620bbcd56a02697d07b002", "lessThan": "9f3d9b68c1c6c51746e5ecdb52b2e6a2901de37e", "versionType": "git"}, {"status": "affected", "version": "0ab115237025f5e379620bbcd56a02697d07b002", "lessThan": "e7632089523acddcdd8f090ad19e96fb3107b04d", "versionType": "git"}, {"status": "affected", "version": "0ab115237025f5e379620bbcd56a02697d07b002", "lessThan": "53442c7d0c888e51b8bc3da196970a669cc6b294", "versionType": "git"}, {"status": "affected", "version": "0ab115237025f5e379620bbcd56a02697d07b002", "lessThan": "8203f760a72bd39a3b66bc4eff0aa272a99fe22b", "versionType": "git"}, {"status": "affected", "version": "0ab115237025f5e379620bbcd56a02697d07b002", "lessThan": "e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3", "versionType": "git"}], "programFiles": ["net/sunrpc/xprtrdma/backchannel.c", "net/sunrpc/xprtrdma/rpc_rdma.c", "net/sunrpc/xprtrdma/transport.c", "net/sunrpc/xprtrdma/verbs.c", "net/sunrpc/xprtrdma/xprt_rdma.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"status": "unaffected", "version": "0", "lessThan": "5.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sunrpc/xprtrdma/backchannel.c", "net/sunrpc/xprtrdma/rpc_rdma.c", "net/sunrpc/xprtrdma/transport.c", "net/sunrpc/xprtrdma/verbs.c", "net/sunrpc/xprtrdma/xprt_rdma.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/740975054a1970c0cf15f70ac39724a064f45847"}, {"url": "https://git.kernel.org/stable/c/9f3d9b68c1c6c51746e5ecdb52b2e6a2901de37e"}, {"url": "https://git.kernel.org/stable/c/e7632089523acddcdd8f090ad19e96fb3107b04d"}, {"url": "https://git.kernel.org/stable/c/53442c7d0c888e51b8bc3da196970a669cc6b294"}, {"url": "https://git.kernel.org/stable/c/8203f760a72bd39a3b66bc4eff0aa272a99fe22b"}, {"url": "https://git.kernel.org/stable/c/e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Decouple req recycling from RPC completion\n\nrl_kref formerly served two distinct lifetimes through a single\nrefcount: it gated when a Reply could wake its RPC task, and it\ngated when an rpcrdma_req could return to its free pool. The\nmarshal path took the Send-side reference only when SGEs needed\nDMA-unmap (sc_unmap_count > 0), which made a Send carrying only\npre-registered buffers an exception: the Reply handler dropped\nrl_kref from 1 to 0 and freed the req while the HCA might still\nbe DMA-reading from its send buffer.\n\nGive rl_kref a narrower job. The RPC layer takes one reference\nwhen slot allocation hands a req out. rpcrdma_prepare_send_sges()\ntakes a Send-side reference unconditionally after WR preparation\nsucceeds. xprt_rdma_free_slot() and xprt_rdma_bc_free_rqst() drop\nthe RPC-layer reference; rpcrdma_sendctx_unmap() drops the\nSend-side reference. The req returns to its free pool only after\nboth owners have signed off.\n\nThe existing kref_init(&req->rl_kref) call in\nrpcrdma_prepare_send_sges() is removed. Initialization moves to\nthe slot-allocation paths (xprt_rdma_alloc_slot and\nrpcrdma_bc_rqst_get), and the release callback re-arms rl_kref\nbefore the req returns to a free pool. A re-init in the marshal\npath would discard the RPC-layer reference that already exists\non entry.\n\nThree invariants follow:\n\n - Any rpcrdma_req held by an rpc_rqst has rl_kref >= 1.\n xprt_rdma_alloc_slot(), rpcrdma_bc_rqst_get(), and the\n backlog-wake branch in xprt_rdma_alloc_slot() each kref_init\n rl_kref before publishing the req. Without this invariant,\n an RPC task that aborts between slot allocation and marshal\n (gss_refresh failure or signal during call_connect, for\n example) would drive xprt_release() ->\n xprt_rdma_free_slot() -> kref_put against a refcount of\n zero, saturating refcount_t and stranding the slot.\n\n - The Send-side reference is taken only after WR prep\n succeeds. A mapping failure in rpcrdma_prepare_send_sges()\n runs rpcrdma_sendctx_cancel(), which DMA-unmaps the sendctx\n and clears sc_req without touching rl_kref. The sendctx\n ring walks in rpcrdma_sendctx_put_locked() and\n rpcrdma_sendctxs_destroy() skip entries with sc_req == NULL,\n so a burst of -EIO marshal failures cannot hold reqs off\n rb_send_bufs.\n\n - The release callback re-arms rl_kref so the next consumer\n enters with the invariant satisfied.\n\nReplies now complete the RPC directly. rpcrdma_reply_handler()\ncalls rpcrdma_complete_rqst() in place of kref_put on the\nnon-LocalInv branch. The LocalInv branch already completes the\nRPC from frwr_unmap_async() and is unaffected.\n\nBecause Send-side references can now outlive RPC completion,\nconnection teardown drains sendctx entries whose unsignaled\nSends never had a later signaled completion to walk the ring.\nrpcrdma_sendctxs_destroy() walks the active range and runs\nrpcrdma_sendctx_unmap() on each entry with a non-NULL sc_req\nbefore the request buffers are reset, and is moved ahead of\nrpcrdma_reqs_reset() in rpcrdma_xprt_disconnect() so the reqs\nare still in their pre-reset state when the Send-side refs are\nreleased.\n\nThe drain creates a teardown-ordering hazard on the backchannel\npath. With the new lifetime, releasing a bc_prealloc req from\nrpcrdma_req_release() re-adds it to bc_pa_list. The disconnect\nin xprt_rdma_destroy() runs after xprt_destroy_backchannel() has\nalready emptied bc_pa_list, so the drained reqs would otherwise\nleak. xprt_rdma_destroy() now runs xprt_rdma_bc_destroy(xprt, 0)\na second time after the disconnect to reclaim them."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:44:39.513Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72473", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:25.751Z", "dateReserved": "2026-08-09T03:40:39.934Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:57:14.412Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sunrpc/xprtrdma/backchannel.c", "net/sunrpc/xprtrdma/rpc_rdma.c", "net/sunrpc/xprtrdma/transport.c", "net/sunrpc/xprtrdma/verbs.c", "net/sunrpc/xprtrdma/xprt_rdma.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "740975054a1970c0cf15f70ac39724a064f45847", "status": "affected", "version": "0ab115237025f5e379620bbcd56a02697d07b002", "versionType": "git"}, {"lessThan": "9f3d9b68c1c6c51746e5ecdb52b2e6a2901de37e", "status": "affected", "version": "0ab115237025f5e379620bbcd56a02697d07b002", "versionType": "git"}, {"lessThan": "e7632089523acddcdd8f090ad19e96fb3107b04d", "status": "affected", "version": "0ab115237025f5e379620bbcd56a02697d07b002", "versionType": "git"}, {"lessThan": "53442c7d0c888e51b8bc3da196970a669cc6b294", "status": "affected", "version": "0ab115237025f5e379620bbcd56a02697d07b002", "versionType": "git"}, {"lessThan": "8203f760a72bd39a3b66bc4eff0aa272a99fe22b", "status": "affected", "version": "0ab115237025f5e379620bbcd56a02697d07b002", "versionType": "git"}, {"lessThan": "e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3", "status": "affected", "version": "0ab115237025f5e379620bbcd56a02697d07b002", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sunrpc/xprtrdma/backchannel.c", "net/sunrpc/xprtrdma/rpc_rdma.c", "net/sunrpc/xprtrdma/transport.c", "net/sunrpc/xprtrdma/verbs.c", "net/sunrpc/xprtrdma/xprt_rdma.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"lessThan": "5.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Decouple req recycling from RPC completion\n\nrl_kref formerly served two distinct lifetimes through a single\nrefcount: it gated when a Reply could wake its RPC task, and it\ngated when an rpcrdma_req could return to its free pool. The\nmarshal path took the Send-side reference only when SGEs needed\nDMA-unmap (sc_unmap_count > 0), which made a Send carrying only\npre-registered buffers an exception: the Reply handler dropped\nrl_kref from 1 to 0 and freed the req while the HCA might still\nbe DMA-reading from its send buffer.\n\nGive rl_kref a narrower job. The RPC layer takes one reference\nwhen slot allocation hands a req out. rpcrdma_prepare_send_sges()\ntakes a Send-side reference unconditionally after WR preparation\nsucceeds. xprt_rdma_free_slot() and xprt_rdma_bc_free_rqst() drop\nthe RPC-layer reference; rpcrdma_sendctx_unmap() drops the\nSend-side reference. The req returns to its free pool only after\nboth owners have signed off.\n\nThe existing kref_init(&req->rl_kref) call in\nrpcrdma_prepare_send_sges() is removed. Initialization moves to\nthe slot-allocation paths (xprt_rdma_alloc_slot and\nrpcrdma_bc_rqst_get), and the release callback re-arms rl_kref\nbefore the req returns to a free pool. A re-init in the marshal\npath would discard the RPC-layer reference that already exists\non entry.\n\nThree invariants follow:\n\n - Any rpcrdma_req held by an rpc_rqst has rl_kref >= 1.\n xprt_rdma_alloc_slot(), rpcrdma_bc_rqst_get(), and the\n backlog-wake branch in xprt_rdma_alloc_slot() each kref_init\n rl_kref before publishing the req. Without this invariant,\n an RPC task that aborts between slot allocation and marshal\n (gss_refresh failure or signal during call_connect, for\n example) would drive xprt_release() ->\n xprt_rdma_free_slot() -> kref_put against a refcount of\n zero, saturating refcount_t and stranding the slot.\n\n - The Send-side reference is taken only after WR prep\n succeeds. A mapping failure in rpcrdma_prepare_send_sges()\n runs rpcrdma_sendctx_cancel(), which DMA-unmaps the sendctx\n and clears sc_req without touching rl_kref. The sendctx\n ring walks in rpcrdma_sendctx_put_locked() and\n rpcrdma_sendctxs_destroy() skip entries with sc_req == NULL,\n so a burst of -EIO marshal failures cannot hold reqs off\n rb_send_bufs.\n\n - The release callback re-arms rl_kref so the next consumer\n enters with the invariant satisfied.\n\nReplies now complete the RPC directly. rpcrdma_reply_handler()\ncalls rpcrdma_complete_rqst() in place of kref_put on the\nnon-LocalInv branch. The LocalInv branch already completes the\nRPC from frwr_unmap_async() and is unaffected.\n\nBecause Send-side references can now outlive RPC completion,\nconnection teardown drains sendctx entries whose unsignaled\nSends never had a later signaled completion to walk the ring.\nrpcrdma_sendctxs_destroy() walks the active range and runs\nrpcrdma_sendctx_unmap() on each entry with a non-NULL sc_req\nbefore the request buffers are reset, and is moved ahead of\nrpcrdma_reqs_reset() in rpcrdma_xprt_disconnect() so the reqs\nare still in their pre-reset state when the Send-side refs are\nreleased.\n\nThe drain creates a teardown-ordering hazard on the backchannel\npath. With the new lifetime, releasing a bc_prealloc req from\nrpcrdma_req_release() re-adds it to bc_pa_list. The disconnect\nin xprt_rdma_destroy() runs after xprt_destroy_backchannel() has\nalready emptied bc_pa_list, so the drained reqs would otherwise\nleak. xprt_rdma_destroy() now runs xprt_rdma_bc_destroy(xprt, 0)\na second time after the disconnect to reclaim them."}], "id": "CVE-2026-72473", "lastModified": "2026-10-16T19:17:32.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72473", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:50:33.438850Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:21.423", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/53442c7d0c888e51b8bc3da196970a669cc6b294"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/740975054a1970c0cf15f70ac39724a064f45847"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8203f760a72bd39a3b66bc4eff0aa272a99fe22b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9f3d9b68c1c6c51746e5ecdb52b2e6a2901de37e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7632089523acddcdd8f090ad19e96fb3107b04d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: xprtrdma: Decouple req recycling from RPC completion", "id": "2516546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516546"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxprtrdma: Decouple req recycling from RPC completion\nrl_kref formerly served two distinct lifetimes through a single\nrefcount: it gated when a Reply could wake its RPC task, and it\ngated when an rpcrdma_req could return to its free pool. The\nmarshal path took the Send-side reference only when SGEs needed\nDMA-unmap (sc_unmap_count > 0), which made a Send carrying only\npre-registered buffers an exception: the Reply handler dropped\nrl_kref from 1 to 0 and freed the req while the HCA might still\nbe DMA-reading from its send buffer.\nGive rl_kref a narrower job. The RPC layer takes one reference\nwhen slot allocation hands a req out. rpcrdma_prepare_send_sges()\ntakes a Send-side reference unconditionally after WR preparation\nsucceeds. xprt_rdma_free_slot() and xprt_rdma_bc_free_rqst() drop\nthe RPC-layer reference; rpcrdma_sendctx_unmap() drops the\nSend-side reference. The req returns to its free pool only after\nboth owners have signed off.\nThe existing kref_init(&req->rl_kref) call in\nrpcrdma_prepare_send_sges() is removed. Initialization moves to\nthe slot-allocation paths (xprt_rdma_alloc_slot and\nrpcrdma_bc_rqst_get), and the release callback re-arms rl_kref\nbefore the req returns to a free pool. A re-init in the marshal\npath would discard the RPC-layer reference that already exists\non entry.\nThree invariants follow:\n- Any rpcrdma_req held by an rpc_rqst has rl_kref >= 1.\nxprt_rdma_alloc_slot(), rpcrdma_bc_rqst_get(), and the\nbacklog-wake branch in xprt_rdma_alloc_slot() each kref_init\nrl_kref before publishing the req. Without this invariant,\nan RPC task that aborts between slot allocation and marshal\n(gss_refresh failure or signal during call_connect, for\nexample) would drive xprt_release() ->\nxprt_rdma_free_slot() -> kref_put against a refcount of\nzero, saturating refcount_t and stranding the slot.\n- The Send-side reference is taken only after WR prep\nsucceeds. A mapping failure in rpcrdma_prepare_send_sges()\nruns rpcrdma_sendctx_cancel(), which DMA-unmaps the sendctx\nand clears sc_req without touching rl_kref. The sendctx\nring walks in rpcrdma_sendctx_put_locked() and\nrpcrdma_sendctxs_destroy() skip entries with sc_req == NULL,\nso a burst of -EIO marshal failures cannot hold reqs off\nrb_send_bufs.\n- The release callback re-arms rl_kref so the next consumer\nenters with the invariant satisfied.\nReplies now complete the RPC directly. rpcrdma_reply_handler()\ncalls rpcrdma_complete_rqst() in place of kref_put on the\nnon-LocalInv branch. The LocalInv branch already completes the\nRPC from frwr_unmap_async() and is unaffected.\nBecause Send-side references can now outlive RPC completion,\nconnection teardown drains sendctx entries whose unsignaled\nSends never had a later signaled completion to walk the ring.\nrpcrdma_sendctxs_destroy() walks the active range and runs\nrpcrdma_sendctx_unmap() on each entry with a non-NULL sc_req\nbefore the request buffers are reset, and is moved ahead of\nrpcrdma_reqs_reset() in rpcrdma_xprt_disconnect() so the reqs\nare still in their pre-reset state when the Send-side refs are\nreleased.\nThe drain creates a teardown-ordering hazard on the backchannel\npath. With the new lifetime, releasing a bc_prealloc req from\nrpcrdma_req_release() re-adds it to bc_pa_list. The disconnect\nin xprt_rdma_destroy() runs after xprt_destroy_backchannel() has\nalready emptied bc_pa_list, so the drained reqs would otherwise\nleak. xprt_rdma_destroy() now runs xprt_rdma_bc_destroy(xprt, 0)\na second time after the disconnect to reclaim them.", "A flaw was found in the xprtrdma module of the Linux kernel. This vulnerability involves an issue with how the system manages references to data requests, potentially allowing a request to be released while it is still actively being used by the hardware. This improper handling of resources could lead to memory corruption, which an attacker might leverage to cause system instability or a denial of service (DoS)."], "name": "CVE-2026-72473", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72473\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72473\nhttps://lore.kernel.org/linux-cve-announce/2026081535-CVE-2026-72473-0181@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ab115237025f5e379620bbcd56a02697d07b002,740975054a1970c0cf15f70ac39724a064f45847)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ab115237025f5e379620bbcd56a02697d07b002,9f3d9b68c1c6c51746e5ecdb52b2e6a2901de37e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ab115237025f5e379620bbcd56a02697d07b002,e7632089523acddcdd8f090ad19e96fb3107b04d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ab115237025f5e379620bbcd56a02697d07b002,53442c7d0c888e51b8bc3da196970a669cc6b294)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ab115237025f5e379620bbcd56a02697d07b002,8203f760a72bd39a3b66bc4eff0aa272a99fe22b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ab115237025f5e379620bbcd56a02697d07b002,e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T12:30:07.845046+00:00", "updated": "2026-08-22T04:45:03.426789+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}