CVE-2026-72468 Linux CVE debrief

Who should care

Linux system administrators and users who manage or utilize NFS/RDMA mounts should be aware of this vulnerability and take steps to apply the official patch to prevent potential kernel crashes. This includes reviewing system configurations, updating vulnerable systems, and monitoring for potential local administrator exploitation attempts. Security teams and vulnerability management teams should also prioritize patching and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, operators and platform administrators should be aware of the potential impact on their systems and take steps to mitigate the vulnerability. Vulnerability management teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams should review relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory management teams should also review their asset inventories to ensure that all affected systems are accounted for and prioritized for patching. Overall, this vulnerability affects Linux system administrators, users, security teams, vulnerability management teams, operators, and platform administrators who need to take steps to mitigate the vulnerability and prevent potential kernel crashes. The vulnerability management process should include verifying affected scope, severity, and vendor guidance, planning vendor-supported updates or mitigations, and reviewing compensating controls for exposed systems. The security team should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. The asset inventory management team should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. The security team should also check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. The vulnerability management team should prioritize patching and review compensating controls for exposed systems while remediation

Technical summary

The Linux kernel vulnerability allows a local administrator to potentially crash the kernel by racing an NFS/RDMA mount against RDMA device removal due to the delayed assignment of ep->re_id in rpcrdma_ep_create(). The issue arises from the Linux kernel's handling of RDMA device removal and NFS/RDMA mounts. The vulnerability has been resolved with an update to the rpcrdma_ep_create() function, ensuring that the rdma_cm_id is stored in ep->re_id immediately before publishing ep->re_rn.

Defensive priority

Apply the official patch to prevent potential kernel crashes.

Recommended defensive actions

• Apply the official patch to prevent potential kernel crashes.
• Inventory and prioritize Linux systems for patching.
• Monitor for potential local administrator exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The Linux kernel vulnerability allows a local administrator to potentially crash the kernel by racing an NFS/RDMA mount against RDMA device removal. The issue arises from the delayed assignment of ep->re_id in rpcrdma_ep_create().

Official resources