CVE-2026-72469 (GCVE-0-2026-72469)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:44
VLAI
Title
xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
Summary
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE rpcrdma_cm_event_handler() falls through to the disconnected: label on RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no matching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED. The kref then underflows during connect teardown and rpcrdma_xprt_disconnect() operates on a freed ep. Reference counts across a normal connection lifecycle: rpcrdma_ep_create() kref_init ->1 rpcrdma_xprt_connect() ep_get ->2 (before post_recvs) RDMA_CM_EVENT_ESTABLISHED ep_get ->3 RDMA_CM_EVENT_DISCONNECTED ep_put ->2 rpcrdma_xprt_drain() ep_put ->1 rpcrdma_xprt_disconnect() tail ep_put ->0 (ep_destroy) The connect-time get in rpcrdma_xprt_connect(), taken just before rpcrdma_post_recvs() "while there are outstanding Receives," is balanced by rpcrdma_xprt_drain. ADDR_CHANGE before ESTABLISHED has no get to consume, so its put drops the count to 1 and the drain put then frees the ep while rpcrdma_xprt_disconnect() still holds a pointer to it. Fix by dispatching on the prior re_connect_status via xchg(): for prev == 0 (pre-ESTABLISHED) wake the connect waiter and return with no put; for prev == 1 call rpcrdma_force_disconnect() and return. The case-1 arm relies on the subsequent RDMA_CM_EVENT_DISCONNECTED event -- reliably delivered when rdma_disconnect() is called on a still-connected cm_id -- to balance the ESTABLISHED get; rpcrdma_xprt_drain() continues to balance only that connect-time get. Any other prior value means teardown is already in flight.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2acc5cae292355f5f18ad377a2a966e7f03c8fec , < cfd1bab66b042da7a778786685125656c695931b (git)
Affected: 2acc5cae292355f5f18ad377a2a966e7f03c8fec , < d0479c2b12974aa188b10d221a5770126b118b6d (git)
Affected: 2acc5cae292355f5f18ad377a2a966e7f03c8fec , < ffc07790539736a5d029f6a3c966b46c529f93a8 (git)
Affected: 2acc5cae292355f5f18ad377a2a966e7f03c8fec , < af9b65b29af341932625c4283dc7a23cdb62688a (git)
Affected: 2fcbf07a4f23174a45e015b62a8e42ddbc2e53ef (git)
Affected: 5.7.9 , < 5.8 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cfd1bab66b042da7a778786685125656c695931b",
              "status": "affected",
              "version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec",
              "versionType": "git"
            },
            {
              "lessThan": "d0479c2b12974aa188b10d221a5770126b118b6d",
              "status": "affected",
              "version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec",
              "versionType": "git"
            },
            {
              "lessThan": "ffc07790539736a5d029f6a3c966b46c529f93a8",
              "status": "affected",
              "version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec",
              "versionType": "git"
            },
            {
              "lessThan": "af9b65b29af341932625c4283dc7a23cdb62688a",
              "status": "affected",
              "version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2fcbf07a4f23174a45e015b62a8e42ddbc2e53ef",
              "versionType": "git"
            },
            {
              "lessThan": "5.8",
              "status": "affected",
              "version": "5.7.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.7.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Fix ep kref imbalance on ADDR_CHANGE\n\nrpcrdma_cm_event_handler() falls through to the disconnected: label\non RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no\nmatching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED.\nThe kref then underflows during connect teardown and\nrpcrdma_xprt_disconnect() operates on a freed ep.\n\nReference counts across a normal connection lifecycle:\n\n    rpcrdma_ep_create()             kref_init     -\u003e1\n    rpcrdma_xprt_connect()          ep_get        -\u003e2  (before post_recvs)\n    RDMA_CM_EVENT_ESTABLISHED       ep_get        -\u003e3\n    RDMA_CM_EVENT_DISCONNECTED      ep_put        -\u003e2\n    rpcrdma_xprt_drain()            ep_put        -\u003e1\n    rpcrdma_xprt_disconnect() tail  ep_put        -\u003e0  (ep_destroy)\n\nThe connect-time get in rpcrdma_xprt_connect(), taken just before\nrpcrdma_post_recvs() \"while there are outstanding Receives,\" is\nbalanced by rpcrdma_xprt_drain. ADDR_CHANGE before ESTABLISHED has\nno get to consume, so its put drops the count to 1 and the drain\nput then frees the ep while rpcrdma_xprt_disconnect() still holds a\npointer to it.\n\nFix by dispatching on the prior re_connect_status via xchg(): for\nprev == 0 (pre-ESTABLISHED) wake the connect waiter and return with\nno put; for prev == 1 call rpcrdma_force_disconnect() and return.\nThe case-1 arm relies on the subsequent RDMA_CM_EVENT_DISCONNECTED\nevent -- reliably delivered when rdma_disconnect() is called on a\nstill-connected cm_id -- to balance the ESTABLISHED get;\nrpcrdma_xprt_drain() continues to balance only that connect-time\nget. Any other prior value means teardown is already in flight."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in the NFS/RPC-over-RDMA client reached during RDMA CM connect/reconnect to a remote server; ADDR_CHANGE is delivered on bonded RoCE/IB netdev failover on the storage network segment, a plausible adjacent-network trigger in HPC and cloud NFS-over-RDMA deployments.\nAC:L - Once NFS-over-RDMA is in use, an attacker can reliably drive repeated reconnect attempts and time or induce bonding failover so ADDR_CHANGE arrives pre-ESTABLISHED; the resulting kref underflow and UAF are deterministic, not a probabilistic memory-layout race.\nPR:N - Exploitation requires no privileges on the victim host\u2014only that NFS-over-RDMA is configured and reconnects occur\u2014while an adjacent attacker or malicious storage peer can provoke link failover and connection churn without authenticating to the victim system.\nUI:N - No victim user interaction is required beyond normal automated NFS-over-RDMA client reconnect activity already performed by the kernel when links fail or sessions drop.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - Premature free of rpcrdma_ep leaves dangling pointers used in rpcrdma_xprt_disconnect (rdma_disconnect, ib_drain_rq/sq), a classic kernel heap UAF that can be leveraged for arbitrary memory disclosure via controlled reuse of the freed endpoint object.\nI:H - Teardown continues to operate on the freed endpoint and associated RDMA/IB state, enabling heap corruption and potential arbitrary kernel write or control-flow hijack, not merely a benign NULL dereference crash.\nA:H - The kref imbalance causes premature endpoint destruction during disconnect teardown, which can trigger kernel oops/panic from use-after-free even when exploitation for code execution is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:33.996Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cfd1bab66b042da7a778786685125656c695931b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0479c2b12974aa188b10d221a5770126b118b6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffc07790539736a5d029f6a3c966b46c529f93a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a"
        }
      ],
      "title": "xprtrdma: Fix ep kref imbalance on ADDR_CHANGE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72469",
    "datePublished": "2026-08-15T05:57:11.829Z",
    "dateReserved": "2026-08-09T03:40:39.934Z",
    "dateUpdated": "2026-08-17T05:44:33.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72469",
      "date": "2026-09-20",
      "epss": "0.00317",
      "percentile": "0.24884"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T15:03:25.000Z",
      "cve": "CVE-2026-72469",
      "id": "msrc_CVE-2026-72469",
      "initial_release_date": "2026-08-23T15:03:25.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "xprtrdma: Fix ep kref imbalance on ADDR_CHANGE",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72469.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cfd1bab66b042da7a778786685125656c695931b",
                    "status": "affected",
                    "version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d0479c2b12974aa188b10d221a5770126b118b6d",
                    "status": "affected",
                    "version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ffc07790539736a5d029f6a3c966b46c529f93a8",
                    "status": "affected",
                    "version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "af9b65b29af341932625c4283dc7a23cdb62688a",
                    "status": "affected",
                    "version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "2fcbf07a4f23174a45e015b62a8e42ddbc2e53ef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.8",
                    "status": "affected",
                    "version": "5.7.9",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.8"
                  },
                  {
                    "lessThan": "5.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Fix ep kref imbalance on ADDR_CHANGE\n\nrpcrdma_cm_event_handler() falls through to the disconnected: label\non RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no\nmatching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED.\nThe kref then underflows during connect teardown and\nrpcrdma_xprt_disconnect() operates on a freed ep.\n\nReference counts across a normal connection lifecycle:\n\n    rpcrdma_ep_create()             kref_init     -\u003e1\n    rpcrdma_xprt_connect()          ep_get        -\u003e2  (before post_recvs)\n    RDMA_CM_EVENT_ESTABLISHED       ep_get        -\u003e3\n    RDMA_CM_EVENT_DISCONNECTED      ep_put        -\u003e2\n    rpcrdma_xprt_drain()            ep_put        -\u003e1\n    rpcrdma_xprt_disconnect() tail  ep_put        -\u003e0  (ep_destroy)\n\nThe connect-time get in rpcrdma_xprt_connect(), taken just before\nrpcrdma_post_recvs() \"while there are outstanding Receives,\" is\nbalanced by rpcrdma_xprt_drain. ADDR_CHANGE before ESTABLISHED has\nno get to consume, so its put drops the count to 1 and the drain\nput then frees the ep while rpcrdma_xprt_disconnect() still holds a\npointer to it.\n\nFix by dispatching on the prior re_connect_status via xchg(): for\nprev == 0 (pre-ESTABLISHED) wake the connect waiter and return with\nno put; for prev == 1 call rpcrdma_force_disconnect() and return.\nThe case-1 arm relies on the subsequent RDMA_CM_EVENT_DISCONNECTED\nevent -- reliably delivered when rdma_disconnect() is called on a\nstill-connected cm_id -- to balance the ESTABLISHED get;\nrpcrdma_xprt_drain() continues to balance only that connect-time\nget. Any other prior value means teardown is already in flight."
          }
        ],
        "id": "CVE-2026-72469",
        "lastModified": "2026-08-17T06:19:14.773",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:20.997",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cfd1bab66b042da7a778786685125656c695931b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d0479c2b12974aa188b10d221a5770126b118b6d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ffc07790539736a5d029f6a3c966b46c529f93a8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T18:09:54+00:00",
      "cve": "CVE-2026-72469",
      "id": "CVE-2026-72469",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72469.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:28:02Z",
      "cve": "CVE-2026-72469",
      "id": "CVE-2026-72469",
      "initial_release_date": "2026-08-27T16:52:17Z",
      "product_status:known_affected": "576",
      "product_status:known_not_affected": "143",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72469",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72469.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.