CVE-2026-72466 Linux CVE debrief

Who should care

Linux kernel users and administrators, network security teams, and Linux kernel developers should be aware of this vulnerability. Affected Linux kernel deployments may be present in managed environments, requiring confirmation and assignment of an owner for follow-up. The vulnerability's impact on various platforms and systems should be reviewed, and compensating controls may be necessary for exposed systems while remediation is scheduled and verified. Monitoring and detection logs for exposed assets should be checked, and exceptions should be tracked and retested before closing the item. This vulnerability may require review by vulnerability-management teams and security teams to ensure proper mitigation and protection of affected systems. Additionally, operators of affected systems should be informed of the potential risks and necessary precautions. Security teams should review the vulnerability's impact on their systems and implement necessary controls to prevent exploitation. The vulnerability's severity and affected scope should be validated, and vendor guidance should be reviewed to ensure proper mitigation. Affected systems should be prioritized for patching or mitigation, and asset inventory management may be necessary to track affected systems. Overall, a comprehensive review of the vulnerability's impact and necessary precautions is required to ensure the security of affected systems and prevent potential exploitation. The CVE record and official advisory should be reviewed for further information and guidance on mitigation and remediation. Linux kernel developers should review the vulnerability and implement necessary patches or mitigations to prevent exploitation. The vulnerability's impact on various platforms and systems should be reviewed, and compensating controls may be necessary for exposed systems while remediation is scheduled and verified. Monitoring and detection logs for exposed assets should be checked, and exceptions should be tracked and retested before closing the item. This vulnerability may require review by vulnerability-management teams and security teams to ensure proper mitigation and protection of affected systems. Additionally,

Technical summary

The Linux kernel's xprtrdma component has a vulnerability that can cause a receive buffer leak and drain the Receive queue. This issue arises from two problems in the rpcrdma_is_bcall decode path. A speculative peek with xdr_inline_decode requests zero bytes, which can cause the five subsequent __be32 reads to walk past the wire payload into stale regbuf contents and misclassify the reply as a backchannel call. Additionally, after the post-peek, the short-header arm returns true without calling rpcrdma_bc_receive_call, causing the reply to be orphaned on rb_all_reps and not reposted.

Defensive priority

Medium

Recommended defensive actions

• Verify Linux kernel versions and patches
• Review xprtrdma component configurations
• Monitor for potential Receive queue draining
• Perform vulnerability scanning to identify potentially affected systems and prioritize patching or mitigation efforts accordingly
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description provides details on a vulnerability in the Linux kernel's xprtrdma component. The issue involves a speculative peek and a short-header arm return that can cause a receive buffer leak and drain the Receive queue. The CVE record was published on 2026-08-15T06:22:20.637Z.

Official resources