Junglewise Threat Intelligence

CVE-2026-72467: Linux kernel xprtrdma null pointer dereference in write-pad MR creation

CVE-2026-72467 · Severity: info · Published 2026-08-15

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's NFS over RDMA (Remote Direct Memory Access) transport layer fails to properly validate the creation of a memory region used for padding write operations. If this memory region creation fails during connection setup, the transport is incorrectly marked as connected, leading to a null pointer dereference when a subsequent read operation attempts to use the uninitialized memory region. This can cause a kernel crash on NFS/RDMA clients.

Technical details

The vulnerability exists in the xprtrdma subsystem (net/sunrpc/xprtrdma/verbs.c) in the rpcrdma_xprt_connect() function. The frwr_wp_create() function creates a singleton memory region for encoding padding on non-XDR-aligned write chunks, but its return value indicating failure was not checked. If frwr_wp_create() fails after other connection setup succeeds, the function still returns success, allowing xprt_rdma_connect_worker() to set XPRT_CONNECTED. Subsequently, when rpcrdma_encode_write_list() attempts to use the write-pad memory region without NULL checking, it dereferences a NULL pointer and causes a kernel panic. The attack vector is local: this can only be triggered by an NFS/RDMA client experiencing local memory region allocation, DMA mapping, or post-send failures during connect/reconnect. The fix adds a return value check on frwr_wp_create() and fails the connection attempt with -ENOTCONN if it returns an error, allowing the normal reconnect path to retry.

Affected products

  • Linux Linux kernel Linux 5.0 through 6.19 (and earlier versions with xprtrdma subsystem)

Timeline

  • 2026-08-15: disclosed
  • 2026-06-04: patched: Upstream fix committed by Chuck Lever

References

Related threats