Junglewise Threat Intelligence

CVE-2026-72150: Linux kernel sunrpc uninitialized structure in xprt_create_args

CVE-2026-72150 · Severity: info · Published 2026-08-15

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's sunrpc (Sun RPC) subsystem, which handles remote procedure calls used by network file systems like NFS, contained a vulnerability where a data structure was not properly initialized before use. This could cause the kernel to crash, leak sensitive data from kernel memory, or behave unpredictably when RPC transport connections are configured through the sysfs interface.

Technical details

The vulnerability is an uninitialized stack variable in the sunrpc sysfs code. In rpc_sysfs_xprt_switch_add_xprt_store(), the xprt_create_args structure is allocated on the stack without zero-initialization, leaving fields like srcaddr, bc_xps, and flags containing uninitialized stack garbage. When xs_setup_xprt() processes this structure, it may dereference garbage pointers (kernel panic), leak sensitive stack data if srcaddr inadvertently points to kernel memory, or exhibit unpredictable behavior if random bits in the flags field are set. The fix is trivial: change the declaration from `struct xprt_create xprt_create_args;` to `struct xprt_create xprt_create_args = {};` to zero-initialize all fields. The vulnerability affects code reachable through sysfs configuration of RPC transports, typically requiring local or privileged access to trigger.

Affected products

  • Linux Linux kernel

Timeline

  • 2026-06-03: disclosed: Patch submitted by Hongling Zeng
  • 2026-06-08: patched: Merged into mainline by Anna Schumaker
  • 2026-08-15: advisory: Published as CVE-2026-72150

References

Related threats