Executive brief
The Linux kernel's sunrpc (Sun RPC) subsystem, which handles remote procedure calls used by network file systems like NFS, contained a vulnerability where a data structure was not properly initialized before use. This could cause the kernel to crash, leak sensitive data from kernel memory, or behave unpredictably when RPC transport connections are configured through the sysfs interface.
Technical details
The vulnerability is an uninitialized stack variable in the sunrpc sysfs code. In rpc_sysfs_xprt_switch_add_xprt_store(), the xprt_create_args structure is allocated on the stack without zero-initialization, leaving fields like srcaddr, bc_xps, and flags containing uninitialized stack garbage. When xs_setup_xprt() processes this structure, it may dereference garbage pointers (kernel panic), leak sensitive stack data if srcaddr inadvertently points to kernel memory, or exhibit unpredictable behavior if random bits in the flags field are set. The fix is trivial: change the declaration from `struct xprt_create xprt_create_args;` to `struct xprt_create xprt_create_args = {};` to zero-initialize all fields. The vulnerability affects code reachable through sysfs configuration of RPC transports, typically requiring local or privileged access to trigger.
Affected products
- Linux Linux kernel
Timeline
- 2026-06-03: disclosed: Patch submitted by Hongling Zeng
- 2026-06-08: patched: Merged into mainline by Anna Schumaker
- 2026-08-15: advisory: Published as CVE-2026-72150