Junglewise Threat Intelligence

CVE-2026-72466: Linux kernel xprtrdma receive buffer leak and queue drain

CVE-2026-72466 · Severity: critical · CVSS 9.8 · Published 2026-08-15

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A flaw in the Linux kernel's remote direct memory access (RDMA) transport layer can cause receive buffers to leak and exhaust the receive queue when processing malformed or short network replies. An attacker sending crafted network packets can cause persistent memory leaks and degrade network performance for systems relying on RDMA communication, potentially leading to denial of service.

Technical details

The vulnerability exists in rpcrdma_is_bcall(), which decodes reply headers to classify frames as backchannel calls. A speculative zero-length peek to xdr_inline_decode() returns a pointer without bounds checking, allowing five subsequent 32-bit reads to access up to 20 bytes past the wire payload into stale buffer contents. Additionally, the short-header arm returns true without invoking rpcrdma_bc_receive_call(), causing rpcrdma_reply_handler() to bare-return and skip cleanup (rpcrdma_rep_put() and rpcrdma_post_recvs()). This orphans the DMA-mapped receive buffer, which is freed only at transport teardown. The fix adds bounds checking against xdr->end after the speculative peek and changes the short-header arm to return false, ensuring proper cleanup and receive queue replenishment.

Affected products

  • Linux Linux kernel unspecified

Timeline

  • 2026-08-15: published

Related threats