CVE-2026-72465 (GCVE-0-2026-72465)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:44
VLAI
Title
xprtrdma: Sanitize the reply credit grant after parsing
Summary
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The out_norqst exit in rpcrdma_reply_handler() branches away before the credit clamp, so a reply that matches no pending request reaches out_post carrying the raw credit value parsed from the wire. rpcrdma_post_recvs() does not bound its @needed argument: the refill loop allocates and chains Receive WRs until the count is satisfied or allocation fails. A peer that sends a well-formed reply carrying an unknown XID and an inflated credit grant therefore drives rep allocation and Receive posting past re_max_requests on every such reply. Move the clamp to immediately after the credit field is parsed, ahead of the first branch that can reach out_post, so every later consumer sees a sanitized value. The cwnd update stays on the matched-request path.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d01d6670c169316115b26dfb3585a73dfe40b563 , < 7cf332b3d82d73ffceedca6b4a120be074172021 (git)
Affected: d1b159356a3584943192712392fcb2439aafb8c1 , < 41634242140173eabbf54f899f9c70b5c685e786 (git)
Affected: 17da9e0caa8615f6fc3b4022eadbd78a9aea1a2a , < 8be1bb378def94a5cb8f7527a191e476407118ec (git)
Affected: e7ae0883c8c89b901226de43862184bf37054338 , < 469b22376ee73369711ecf2761bd122ef4195963 (git)
Affected: 704f3f640f72db4d44ec5ce3db8d4e150c974bc7 , < 33db78b1b24fc6a464ae08aa4d2538c5f883eb5e (git)
Affected: 704f3f640f72db4d44ec5ce3db8d4e150c974bc7 , < c3a628aab2dc8f5fd7bff86ceaeae64de590e60a (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/rpc_rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7cf332b3d82d73ffceedca6b4a120be074172021",
              "status": "affected",
              "version": "d01d6670c169316115b26dfb3585a73dfe40b563",
              "versionType": "git"
            },
            {
              "lessThan": "41634242140173eabbf54f899f9c70b5c685e786",
              "status": "affected",
              "version": "d1b159356a3584943192712392fcb2439aafb8c1",
              "versionType": "git"
            },
            {
              "lessThan": "8be1bb378def94a5cb8f7527a191e476407118ec",
              "status": "affected",
              "version": "17da9e0caa8615f6fc3b4022eadbd78a9aea1a2a",
              "versionType": "git"
            },
            {
              "lessThan": "469b22376ee73369711ecf2761bd122ef4195963",
              "status": "affected",
              "version": "e7ae0883c8c89b901226de43862184bf37054338",
              "versionType": "git"
            },
            {
              "lessThan": "33db78b1b24fc6a464ae08aa4d2538c5f883eb5e",
              "status": "affected",
              "version": "704f3f640f72db4d44ec5ce3db8d4e150c974bc7",
              "versionType": "git"
            },
            {
              "lessThan": "c3a628aab2dc8f5fd7bff86ceaeae64de590e60a",
              "status": "affected",
              "version": "704f3f640f72db4d44ec5ce3db8d4e150c974bc7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/rpc_rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Sanitize the reply credit grant after parsing\n\nThe out_norqst exit in rpcrdma_reply_handler() branches away before\nthe credit clamp, so a reply that matches no pending request reaches\nout_post carrying the raw credit value parsed from the wire.\nrpcrdma_post_recvs() does not bound its @needed argument: the refill\nloop allocates and chains Receive WRs until the count is satisfied or\nallocation fails. A peer that sends a well-formed reply carrying an\nunknown XID and an inflated credit grant therefore drives rep\nallocation and Receive posting past re_max_requests on every such\nreply.\n\nMove the clamp to immediately after the credit field is parsed,\nahead of the first branch that can reach out_post, so every later\nconsumer sees a sanitized value. The cwnd update stays on the\nmatched-request path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in the NFS-over-RDMA client receive path: rpcrdma_wc_receive() delivers remote RDMA reply completions to rpcrdma_reply_handler(), so a malicious or compromised NFS/RDMA server can send crafted replies over InfiniBand/RoCE/iWARP without local access.\nAC:L - On an established RPC/RDMA session the peer fully controls inbound replies and can reliably send well-formed headers with an unknown XID and an inflated credit grant on every message, deterministically reaching out_norqst and out_post without races or special victim state.\nPR:N - Exploitation requires only network reachability as the connected RDMA/RPC peer; the attacker does not need local accounts, mount privileges, or namespaced capabilities on the victim NFS client to deliver malicious reply traffic.\nUI:N - Once an NFS-over-RDMA mount and transport session exist, the attacker can flood spurious replies during normal client-server communication without any additional victim or administrator action at exploit time.\nS:U - Impact is confined to excessive kernel memory allocation and denial of service within the NFS client\u0027s SUNRPC/xprtrdma transport; it does not cross VM, container, or IOMMU security boundaries.\nC:N - The bug is unbounded receive-buffer allocation driven by an unsanitized wire credit field, not an out-of-bounds read, use-after-free, or other memory disclosure primitive that exposes kernel data to the attacker.\nI:N - Inflated credits only cause rpcrdma_post_recvs() to allocate and post extra rpcrdma_rep objects; there is no demonstrated memory corruption, arbitrary write, or control-flow hijack primitive.\nA:H - Each spurious reply can drive rpcrdma_rep_create() far past re_max_requests until allocation fails, enabling repeated remote kernel memory exhaustion, OOM conditions, and loss of NFS-over-RDMA service on the client."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:31.793Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7cf332b3d82d73ffceedca6b4a120be074172021"
        },
        {
          "url": "https://git.kernel.org/stable/c/41634242140173eabbf54f899f9c70b5c685e786"
        },
        {
          "url": "https://git.kernel.org/stable/c/8be1bb378def94a5cb8f7527a191e476407118ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/469b22376ee73369711ecf2761bd122ef4195963"
        },
        {
          "url": "https://git.kernel.org/stable/c/33db78b1b24fc6a464ae08aa4d2538c5f883eb5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3a628aab2dc8f5fd7bff86ceaeae64de590e60a"
        }
      ],
      "title": "xprtrdma: Sanitize the reply credit grant after parsing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72465",
    "datePublished": "2026-08-15T05:57:08.767Z",
    "dateReserved": "2026-08-09T03:40:39.933Z",
    "dateUpdated": "2026-08-17T05:44:31.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72465",
      "date": "2026-09-20",
      "epss": "0.00647",
      "percentile": "0.49555"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/rpc_rdma.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7cf332b3d82d73ffceedca6b4a120be074172021",
                    "status": "affected",
                    "version": "d01d6670c169316115b26dfb3585a73dfe40b563",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "41634242140173eabbf54f899f9c70b5c685e786",
                    "status": "affected",
                    "version": "d1b159356a3584943192712392fcb2439aafb8c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8be1bb378def94a5cb8f7527a191e476407118ec",
                    "status": "affected",
                    "version": "17da9e0caa8615f6fc3b4022eadbd78a9aea1a2a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "469b22376ee73369711ecf2761bd122ef4195963",
                    "status": "affected",
                    "version": "e7ae0883c8c89b901226de43862184bf37054338",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "33db78b1b24fc6a464ae08aa4d2538c5f883eb5e",
                    "status": "affected",
                    "version": "704f3f640f72db4d44ec5ce3db8d4e150c974bc7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c3a628aab2dc8f5fd7bff86ceaeae64de590e60a",
                    "status": "affected",
                    "version": "704f3f640f72db4d44ec5ce3db8d4e150c974bc7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/rpc_rdma.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Sanitize the reply credit grant after parsing\n\nThe out_norqst exit in rpcrdma_reply_handler() branches away before\nthe credit clamp, so a reply that matches no pending request reaches\nout_post carrying the raw credit value parsed from the wire.\nrpcrdma_post_recvs() does not bound its @needed argument: the refill\nloop allocates and chains Receive WRs until the count is satisfied or\nallocation fails. A peer that sends a well-formed reply carrying an\nunknown XID and an inflated credit grant therefore drives rep\nallocation and Receive posting past re_max_requests on every such\nreply.\n\nMove the clamp to immediately after the credit field is parsed,\nahead of the first branch that can reach out_post, so every later\nconsumer sees a sanitized value. The cwnd update stays on the\nmatched-request path."
          }
        ],
        "id": "CVE-2026-72465",
        "lastModified": "2026-08-17T06:19:14.310",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:20.527",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/33db78b1b24fc6a464ae08aa4d2538c5f883eb5e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/41634242140173eabbf54f899f9c70b5c685e786"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/469b22376ee73369711ecf2761bd122ef4195963"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7cf332b3d82d73ffceedca6b4a120be074172021"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8be1bb378def94a5cb8f7527a191e476407118ec"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c3a628aab2dc8f5fd7bff86ceaeae64de590e60a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:49:43+00:00",
      "cve": "CVE-2026-72465",
      "id": "CVE-2026-72465",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xprtrdma: Sanitize the reply credit grant after parsing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72465.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-27T16:52:24Z",
      "cve": "CVE-2026-72465",
      "id": "CVE-2026-72465",
      "initial_release_date": "2026-08-27T16:52:24Z",
      "product_status:known_not_affected": "290",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72465",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72465.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.