CVE-2026-72467 Linux CVE debrief

Who should care

Linux kernel developers, administrators using NFS/RDMA clients, and security teams should be aware of this vulnerability and take steps to apply the patch and prevent similar issues. They should review and update NFS/RDMA client configurations to prevent similar issues and monitor system logs for potential NULL pointer dereferences. Additionally, they should verify the patch has been applied and test the configuration to ensure the vulnerability is not exploitable. This may involve coordinating with vendors and other stakeholders to ensure the patch is applied and validated across the organization. Furthermore, they should consider implementing compensating controls, such as monitoring and detection systems, to identify potential exploitation attempts. Asset inventory and rollback/change windows may also be necessary to ensure the vulnerability is properly remediated. Source tracking and exposure review are also recommended to ensure the vulnerability is properly understood and addressed. This may involve reviewing the CVE record and other sources to understand the vulnerability and its potential impact. Finally, they should consider implementing a vendor patch guidance process to ensure that patches are properly applied and validated across the organization. This may involve working with vendors to obtain patches and testing them in a controlled environment before deployment. Overall, a comprehensive approach is needed to address this vulnerability and prevent similar issues in the future. This should include a combination of technical and process changes to ensure the vulnerability is properly remediated and that similar issues are identified and addressed in a timely manner. The goal is to minimize the risk of exploitation and ensure the security and integrity of the system. By taking a proactive and comprehensive approach, organizations can reduce the risk of exploitation and ensure the security and integrity of their systems. This may involve significant resources and effort, but it is essential to protect against potential attacks and maintain the trust and confidence of stakeholders. Therefore, it is essential to prioritize this vulnerability and take all

Technical summary

The rpcrdma_xprt_connect() function in the Linux kernel's xprtrdma module does not check the return value of frwr_wp_create(). This can lead to a NULL pointer dereference in rpcrdma_encode_write_list() if frwr_wp_create() fails after connection setup succeeds. The issue can be triggered locally on an NFS/RDMA client after a connect or reconnect failure. Affected Linux kernel developers and testers should review the patch and apply it to prevent similar issues.

Defensive priority

High

Recommended defensive actions

• Verify and apply the kernel patch to fix the vulnerability
• Review and update NFS/RDMA client configurations to prevent similar issues
• Monitor system logs for potential NULL pointer dereferences
• Perform asset inventory and rollback/change windows to ensure the vulnerability is properly remediated
• Conduct exposure review to understand the vulnerability and its potential impact
• Implement compensating controls, such as monitoring and detection systems, to identify potential exploitation attempts
• Verify vendor patch guidance and apply it to affected systems

Evidence notes

The vulnerability is caused by the rpcrdma_xprt_connect() function not checking the return value of frwr_wp_create(). This can lead to a NULL pointer dereference in rpcrdma_encode_write_list(). The issue can be triggered locally on an NFS/RDMA client after a connect or reconnect failure. Evidence is based on official CVE and NVD records, as well as source references from the Linux kernel.

Official resources