Executive brief
The Linux kernel's RPC binding service can crash when processing memory allocation failures during service registration. When an in-kernel RPC service (such as NFS daemon) attempts to register with the local RPC binding daemon under memory pressure, a failed string allocation can cause a NULL pointer dereference and kernel panic. This impacts availability of RPC-dependent services like NFS.
Technical details
The vulnerability is a NULL pointer dereference in the SUNRPC rpcb_register_inet4() and rpcb_register_inet6() functions. The root cause is that these functions fail to check the return value of rpc_sockaddr2uaddr(), which returns NULL when its internal kstrdup() allocation fails. The unchecked NULL pointer is subsequently passed to encode_rpcb_string(), which calls strlen() on the NULL value, triggering a kernel oops. The attack vector is indirect: the vulnerability is triggered when memory pressure (via failslab or similar conditions) causes the kstrdup() to fail during RPC service registration. The fix is to add NULL checks and return -ENOMEM, mirroring existing error handling in the asynchronous getport code path. No authentication or network access is required; this affects local RPC services running in the kernel.
Affected products
- Linux Linux kernel 6.12 and earlier
Timeline
- 2026-09-16: disclosed