CVE-2026-72150sunrpc: fix uninitialized xprt_create_args structure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix uninitialized xprt_create_args structure The xprt_create_args structure is allocated on the stack without initialization in rpc_sysfs_xprt_switch_add_xprt_store(). While some fields are manually populated, critical fields like srcaddr, bc_xps, and flags contain uninitialized stack garbage. This can lead to: 1. Kernel panic when xs_setup_xprt() dereferences garbage srcaddr 2. Information leak if srcaddr points to sensitive stack data 3. Unpredictable behavior if flags has random bits set The fix is to zero-initialize the structure to ensure all unused fields are NULL/0, preventing the transport setup code from acting on garbage data.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from df210d9b0951d714c1668c511ca5c8ff38cf6916 before 933654508b2bc36e2c3c086c0365e2403fb2141f; from df210d9b0951d714c1668c511ca5c8ff38cf6916 before 7d3ce3bd23c062a7c1c6d372d1b08e48b9e17cc3; from df210d9b0951d714c1668c511ca5c8ff38cf6916 before 17d90b68c3a3d7d7e95b49e1fe9381a723f637a8 | CNA record |
References
- https://git.kernel.org/stable/c/933654508b2bc36e2c3c086c0365e2403fb2141f
- https://git.kernel.org/stable/c/7d3ce3bd23c062a7c1c6d372d1b08e48b9e17cc3
- https://git.kernel.org/stable/c/17d90b68c3a3d7d7e95b49e1fe9381a723f637a8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.