CVE-2026-72467xprtrdma: Check frwr_wp_create() during connect
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwr_wp_create() during connect frwr_wp_create() creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave ep->re_write_pad_mr set to NULL. rpcrdma_xprt_connect() currently ignores that return value. If frwr_wp_create() fails after the rest of the connection setup succeeds, xprt_rdma_connect_worker() treats the connection attempt as successful and sets XPRT_CONNECTED. A later NFS/RDMA read with a non-4-byte-aligned receive page length reaches rpcrdma_encode_write_list(), passes the NULL write-pad MR to encode_rdma_segment(), and dereferences it. This is locally triggerable on an NFS/RDMA client after a connect or reconnect hits a local MR allocation, DMA-map, MR-map, or post-send failure; a remote peer alone cannot force the local MR setup failure. Check the return value and fail the connect as -ENOTCONN, matching the adjacent setup failures. This keeps XPRT_CONNECTED clear and lets the normal reconnect path retry.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 21037b8c2258ec40de3b31be9ced43ceb3b784f7 builds before 3b252fe1778b2cdd68283146455929801bc2abd7; from 21037b8c2258ec40de3b31be9ced43ceb3b784f7 before dd798b76a3481e392820c3ae86ed4592858c6b0f; 21037b8c2258ec40de3b31be9ced43ceb3b784f7 builds before 6b7be4f3feae322f1c2c40a3bdc99db93574a49e; 21037b8c2258ec40de3b31be9ced43ceb3b784f7 builds before 7471e66373a4444a57ef2192f8c4081202c54f45; from 21037b8c2258ec40de3b31be9ced43ceb3b784f7 before ef3b79edf14b6bfb0d21a26ccb0463f9cf82c6a9; 21037b8c2258ec40de3b31be9ced43ceb3b784f7 builds before 0f13fc7c7d2e0427517e63c739277a4cd338b0c5 | CNA record |
References
- https://git.kernel.org/stable/c/3b252fe1778b2cdd68283146455929801bc2abd7
- https://git.kernel.org/stable/c/dd798b76a3481e392820c3ae86ed4592858c6b0f
- https://git.kernel.org/stable/c/6b7be4f3feae322f1c2c40a3bdc99db93574a49e
- https://git.kernel.org/stable/c/7471e66373a4444a57ef2192f8c4081202c54f45
- https://git.kernel.org/stable/c/ef3b79edf14b6bfb0d21a26ccb0463f9cf82c6a9
- https://git.kernel.org/stable/c/0f13fc7c7d2e0427517e63c739277a4cd338b0c5
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.