CVE-2026-72466 (GCVE-0-2026-72466)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:44
VLAI
Title
xprtrdma: Fix bcall rep leak and unbounded peek
Summary
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdma_is_bcall() decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply leak the receive buffer and drain the Receive queue. First, the speculative peek p = xdr_inline_decode(xdr, 0); /* five p++ reads follow */ asks xdr_inline_decode() for zero bytes, which returns xdr->p without consulting xdr->end. The five subsequent __be32 reads can then walk up to 20 bytes past the wire payload into stale regbuf contents and misclassify the reply as a backchannel call. Second, after the post-peek p = xdr_inline_decode(xdr, 3 * sizeof(*p)); if (unlikely(!p)) return true; the short-header arm returns true without calling rpcrdma_bc_receive_call(). The contract with the caller is that a true return transfers ownership of rep to the backchannel path: rpcrdma_reply_handler() if (rpcrdma_is_bcall(r_xprt, rep)) return; /* bare return, skips out_post */ ... out_post: rpcrdma_post_recvs(r_xprt, credits + ...); Because rpcrdma_bc_receive_call() never ran, no one took rep, but rpcrdma_reply_handler still bare-returns past rpcrdma_rep_put() and rpcrdma_post_recvs(). The rep, with its persistently DMA-mapped receive buffer, is orphaned on rb_all_reps and freed only at transport teardown. This completion reposts nothing, so its slot is reclaimed only when a later forward-channel reply reaches out_post and rpcrdma_post_recvs() allocates a fresh rep to backfill; absent that traffic the Receive queue drains and the peer's Sends draw RNR NAKs. Fix by consulting xdr->end after the zero-length peek so the five __be32 reads cannot run unless 20 bytes of wire payload remain. A byte-precise comparison against xdr->end is required because a non-4-aligned receive rounds the stream's word count up past the true payload. Also return false from the short-header arm so the reply falls through the normal out_norqst cleanup chain (rpcrdma_rep_put() plus rpcrdma_post_recvs()).
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 , < 0cee8f9c3b14bd6dee9c4310090a7f45b89b834f (git)
Affected: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 , < 7afc2f8d2fd9394724df9eaf22ce7a71029a5fba (git)
Affected: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 , < 88b5346284a184a6b7d019912232a571d672d3e3 (git)
Affected: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 , < 07aa506436be7634e381e1e1f6d0efa9efc81ecc (git)
Affected: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 , < d7a2870dde3bb09d51d6b9c877642996ad6b92dd (git)
Affected: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 , < 118a16a18c59f7ad8084b2d13988839b669fca10 (git)
Affected: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 , < c7653d5cebc8492c77ec0415b5e9c0fb3e644bc6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/rpc_rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0cee8f9c3b14bd6dee9c4310090a7f45b89b834f",
              "status": "affected",
              "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
              "versionType": "git"
            },
            {
              "lessThan": "7afc2f8d2fd9394724df9eaf22ce7a71029a5fba",
              "status": "affected",
              "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
              "versionType": "git"
            },
            {
              "lessThan": "88b5346284a184a6b7d019912232a571d672d3e3",
              "status": "affected",
              "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
              "versionType": "git"
            },
            {
              "lessThan": "07aa506436be7634e381e1e1f6d0efa9efc81ecc",
              "status": "affected",
              "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
              "versionType": "git"
            },
            {
              "lessThan": "d7a2870dde3bb09d51d6b9c877642996ad6b92dd",
              "status": "affected",
              "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
              "versionType": "git"
            },
            {
              "lessThan": "118a16a18c59f7ad8084b2d13988839b669fca10",
              "status": "affected",
              "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
              "versionType": "git"
            },
            {
              "lessThan": "c7653d5cebc8492c77ec0415b5e9c0fb3e644bc6",
              "status": "affected",
              "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/rpc_rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Fix bcall rep leak and unbounded peek\n\nrpcrdma_is_bcall() decodes a reply\u0027s first words to decide whether\nthe frame is a backchannel call. Two issues in that decode path\nlet a short or malformed reply leak the receive buffer and drain\nthe Receive queue.\n\nFirst, the speculative peek\n\n    p = xdr_inline_decode(xdr, 0);\n    /* five p++ reads follow */\n\nasks xdr_inline_decode() for zero bytes, which returns xdr-\u003ep\nwithout consulting xdr-\u003eend. The five subsequent __be32 reads can\nthen walk up to 20 bytes past the wire payload into stale regbuf\ncontents and misclassify the reply as a backchannel call.\n\nSecond, after the post-peek\n\n    p = xdr_inline_decode(xdr, 3 * sizeof(*p));\n    if (unlikely(!p))\n            return true;\n\nthe short-header arm returns true without calling\nrpcrdma_bc_receive_call(). The contract with the caller is that a\ntrue return transfers ownership of rep to the backchannel path:\n\n    rpcrdma_reply_handler()\n      if (rpcrdma_is_bcall(r_xprt, rep))\n              return;        /* bare return, skips out_post */\n      ...\n    out_post:\n      rpcrdma_post_recvs(r_xprt, credits + ...);\n\nBecause rpcrdma_bc_receive_call() never ran, no one took rep, but\nrpcrdma_reply_handler still bare-returns past rpcrdma_rep_put()\nand rpcrdma_post_recvs(). The rep, with its persistently\nDMA-mapped receive buffer, is orphaned on rb_all_reps and freed\nonly at transport teardown. This completion reposts nothing, so\nits slot is reclaimed only when a later forward-channel reply\nreaches out_post and rpcrdma_post_recvs() allocates a fresh rep to\nbackfill; absent that traffic the Receive queue drains and the\npeer\u0027s Sends draw RNR NAKs.\n\nFix by consulting xdr-\u003eend after the zero-length peek so the five\n__be32 reads cannot run unless 20 bytes of wire payload remain. A\nbyte-precise comparison against xdr-\u003eend is required because a\nnon-4-aligned receive rounds the stream\u0027s word count up past the\ntrue payload. Also return false from the short-header arm so the\nreply falls through the normal out_norqst cleanup chain\n(rpcrdma_rep_put() plus rpcrdma_post_recvs())."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when a remote RDMA peer\u0027s inbound message completes in rpcrdma_wc_receive() and rpcrdma_reply_handler() decodes it; a malicious or compromised NFS-over-RDMA server can send crafted short rdma_msg replies over the established RPC/RDMA connection without local access.\nAC:L - On an active NFSv4.1+ RPC/RDMA session the attacker fully controls inbound replies and can repeatedly send short/malformed rdma_msg frames to hit the zero-length peek and short-header return-true paths, reliably leaking receive buffers and draining the Receive queue.\nPR:N - Exploitation requires only network reachability as the connected RDMA/RPC peer (e.g., a malicious NFS server); no local account, mount privileges, or namespaced capabilities on the victim NFS client are needed to deliver the malformed RDMA replies.\nUI:N - Once an NFS-over-RDMA mount and NFSv4.1 backchannel session exist, triggering the flaw needs no additional victim action beyond the attacker sending malicious RDMA receive payloads during normal client-server communication.\nS:U - The vulnerability and its impact remain within the NFS client\u0027s kernel SUNRPC/xprtrdma transport context; it does not cross a VM, container, or IOMMU security boundary to affect other authorities.\nC:H - xdr_inline_decode(xdr,0) permits up to five subsequent __be32 reads past the wire payload into stale receive-buffer contents, an out-of-bounds read that can misclassify replies and expose remnants of prior RPC/NFS data to unintended processing paths.\nI:H - Stale-buffer-assisted misclassification can treat a forward-channel reply as a backchannel RPC_CALL, a type confusion that routes attacker-influenced bytes into rpcrdma_bc_receive_call()/NFSv4 callback handling and can corrupt client session state.\nA:H - Each successful trigger orphans a DMA-mapped rpcrdma_rep and skips rpcrdma_post_recvs(), monotonically draining the RDMA Receive queue until the peer gets RNR NAKs and the NFS-over-RDMA connection becomes unusable, enabling sustained remote denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:32.887Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0cee8f9c3b14bd6dee9c4310090a7f45b89b834f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7afc2f8d2fd9394724df9eaf22ce7a71029a5fba"
        },
        {
          "url": "https://git.kernel.org/stable/c/88b5346284a184a6b7d019912232a571d672d3e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/07aa506436be7634e381e1e1f6d0efa9efc81ecc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7a2870dde3bb09d51d6b9c877642996ad6b92dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/118a16a18c59f7ad8084b2d13988839b669fca10"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7653d5cebc8492c77ec0415b5e9c0fb3e644bc6"
        }
      ],
      "title": "xprtrdma: Fix bcall rep leak and unbounded peek",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72466",
    "datePublished": "2026-08-15T05:57:09.847Z",
    "dateReserved": "2026-08-09T03:40:39.933Z",
    "dateUpdated": "2026-08-17T05:44:32.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72466",
      "date": "2026-09-20",
      "epss": "0.00728",
      "percentile": "0.52711"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/rpc_rdma.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0cee8f9c3b14bd6dee9c4310090a7f45b89b834f",
                    "status": "affected",
                    "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7afc2f8d2fd9394724df9eaf22ce7a71029a5fba",
                    "status": "affected",
                    "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "88b5346284a184a6b7d019912232a571d672d3e3",
                    "status": "affected",
                    "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "07aa506436be7634e381e1e1f6d0efa9efc81ecc",
                    "status": "affected",
                    "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d7a2870dde3bb09d51d6b9c877642996ad6b92dd",
                    "status": "affected",
                    "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "118a16a18c59f7ad8084b2d13988839b669fca10",
                    "status": "affected",
                    "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c7653d5cebc8492c77ec0415b5e9c0fb3e644bc6",
                    "status": "affected",
                    "version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/rpc_rdma.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.14"
                  },
                  {
                    "lessThan": "4.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Fix bcall rep leak and unbounded peek\n\nrpcrdma_is_bcall() decodes a reply\u0027s first words to decide whether\nthe frame is a backchannel call. Two issues in that decode path\nlet a short or malformed reply leak the receive buffer and drain\nthe Receive queue.\n\nFirst, the speculative peek\n\n    p = xdr_inline_decode(xdr, 0);\n    /* five p++ reads follow */\n\nasks xdr_inline_decode() for zero bytes, which returns xdr-\u003ep\nwithout consulting xdr-\u003eend. The five subsequent __be32 reads can\nthen walk up to 20 bytes past the wire payload into stale regbuf\ncontents and misclassify the reply as a backchannel call.\n\nSecond, after the post-peek\n\n    p = xdr_inline_decode(xdr, 3 * sizeof(*p));\n    if (unlikely(!p))\n            return true;\n\nthe short-header arm returns true without calling\nrpcrdma_bc_receive_call(). The contract with the caller is that a\ntrue return transfers ownership of rep to the backchannel path:\n\n    rpcrdma_reply_handler()\n      if (rpcrdma_is_bcall(r_xprt, rep))\n              return;        /* bare return, skips out_post */\n      ...\n    out_post:\n      rpcrdma_post_recvs(r_xprt, credits + ...);\n\nBecause rpcrdma_bc_receive_call() never ran, no one took rep, but\nrpcrdma_reply_handler still bare-returns past rpcrdma_rep_put()\nand rpcrdma_post_recvs(). The rep, with its persistently\nDMA-mapped receive buffer, is orphaned on rb_all_reps and freed\nonly at transport teardown. This completion reposts nothing, so\nits slot is reclaimed only when a later forward-channel reply\nreaches out_post and rpcrdma_post_recvs() allocates a fresh rep to\nbackfill; absent that traffic the Receive queue drains and the\npeer\u0027s Sends draw RNR NAKs.\n\nFix by consulting xdr-\u003eend after the zero-length peek so the five\n__be32 reads cannot run unless 20 bytes of wire payload remain. A\nbyte-precise comparison against xdr-\u003eend is required because a\nnon-4-aligned receive rounds the stream\u0027s word count up past the\ntrue payload. Also return false from the short-header arm so the\nreply falls through the normal out_norqst cleanup chain\n(rpcrdma_rep_put() plus rpcrdma_post_recvs())."
          }
        ],
        "id": "CVE-2026-72466",
        "lastModified": "2026-08-17T06:19:14.433",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:20.637",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/07aa506436be7634e381e1e1f6d0efa9efc81ecc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0cee8f9c3b14bd6dee9c4310090a7f45b89b834f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/118a16a18c59f7ad8084b2d13988839b669fca10"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7afc2f8d2fd9394724df9eaf22ce7a71029a5fba"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/88b5346284a184a6b7d019912232a571d672d3e3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c7653d5cebc8492c77ec0415b5e9c0fb3e644bc6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d7a2870dde3bb09d51d6b9c877642996ad6b92dd"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:49:45+00:00",
      "cve": "CVE-2026-72466",
      "id": "CVE-2026-72466",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xprtrdma: Fix bcall rep leak and unbounded peek",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72466.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:28:07Z",
      "cve": "CVE-2026-72466",
      "id": "CVE-2026-72466",
      "initial_release_date": "2026-08-27T16:52:22Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "713",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72466",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72466.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.