CVE-2026-72491 Linux Kernel CVE debrief

Who should care

Linux kernel developers and users, 9p RDMA implementation maintainers, and security teams responsible for vulnerability management and patching should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes applying the official patch, reviewing and updating the 9p RDMA implementation, and monitoring for potential use-after-free errors during RDMA request object teardown. Additionally, operators and platform administrators should ensure that their systems are updated with the patched kernel version and that compensating controls are in place to detect and prevent potential attacks. Vulnerability management teams should prioritize this patch and ensure that it is applied to all affected systems in a timely manner. Security teams should also review the 9p RDMA implementation and ensure that it is properly locked and configured to prevent similar vulnerabilities in the future. Asset inventory and monitoring teams should track affected assets and monitor for potential security incidents related to this vulnerability. Rollback and change window management teams should plan and execute the patch deployment in accordance with organizational change management policies. Source tracking teams should monitor for any updates or changes to the CVE record and ensure that all affected systems are updated accordingly. Compensating controls, such as monitoring and detection, should be implemented to detect and prevent potential attacks until the patch can be applied. The patch deployment should be tracked and verified to ensure that all affected systems are patched and that the vulnerability is fully mitigated. The defensive priority of this vulnerability is High, and it should be treated as a high-priority patch deployment. The recommended actions for this vulnerability include applying the official patch, reviewing and updating the 9p RDMA implementation, and monitoring for potential use-after-free errors during RDMA request object teardown. The evidence notes for this vulnerability provide additional context and details on the vulnerability and its mitigation. The technical summary provides a detailed technical overview of the issue and

Technical summary

The rdma->state field is modified without holding req_lock in both recv_done() and p9_cm_event_handler(), while rdma_request() accesses the same field under the req_lock spinlock. This inconsistent locking creates a race condition that can cause lost state transitions, leading to the FLUSHING transition being silently overwritten by CLOSING, corrupting the connection state machine, and potentially causing use-after-free on RDMA request objects during teardown. The fix involves adding req_lock protection to all rdma->state modifications in recv_done() and p9_cm_event_handler(), ensuring that the rdma->state field is accessed and modified in a thread-safe manner.

Defensive priority

High

Recommended defensive actions

• Apply the official patch to update the Linux kernel
• Review and update the 9p RDMA implementation to ensure proper locking
• Monitor for potential use-after-free errors during RDMA request object teardown
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was resolved by adding req_lock protection to all rdma->state modifications in recv_done() and p9_cm_event_handler(), matching the pattern already used in rdma_request(). This change ensures that the rdma->state field is accessed and modified in a thread-safe manner, preventing the race condition that could cause lost state transitions and potentially lead to use-after-free errors. Linux kernel developers should verify the official patch and review the 9p RDMA implementation to ensure proper locking and monitor for potential use-after-free errors during RDMA request object teardown.

Official resources