CVE-2026-72468 - Vulnerability Details

- xprtrdma: Initialize re_id before removal registration

Description

In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: Initialize re_id before removal registration

rpcrdma_create_id() registers ep->re_rn with the rpcrdma ib_client
before returning the new rdma_cm_id to rpcrdma_ep_create(). However
rpcrdma_ep_create() currently stores that pointer in ep->re_id only
after rpcrdma_create_id() returns.

A local administrator can race an NFS/RDMA mount against RDMA device
removal. If rpcrdma_remove_one() observes the just-registered
notification before rpcrdma_ep_create() assigns ep->re_id,
rpcrdma_ep_removal_done() calls trace_xprtrdma_device_removal(NULL).
The tracepoint dereferences id->device->name and copies
id->route.addr.dst_addr, so the callback can crash the kernel with a
NULL pointer dereference.

Store the rdma_cm_id in ep->re_id immediately before publishing
ep->re_rn. The existing error path still destroys the id directly if
registration fails; ep is then freed by the caller without using
ep->re_id. Remove the later duplicate assignment in rpcrdma_ep_create().

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A null pointer dereference occurs in the Linux kernel’s RDMA implementation when a local administrator races an NFS/RDMA mount against RDMA device removal. The race causes the removal callback to reference an uninitialized rdma_cm_id, resulting in a kernel crash via a NULL pointer dereference. The crash leads to a denial of service by crashing the kernel.

Affected Systems

The vulnerability is present in all Linux kernel versions that include the xprtrdma component before the fix is applied. The identified patch commits (264ccd78, 28743571, 51248d87, bb7caa63) globally resolve the issue, so any kernel that has not applied those commits is affected.

Risk and Exploitability

The CVSS score of 5.5 classifies this vulnerability as medium severity; the EPSS score of < 1% indicates a low probability of exploitation. The requirement of local administrative privileges limits the attack surface. However, the crash is straightforward to trigger by timing RDMA device removal during an active mounting operation, and the resulting denial of service can impact system availability. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3f4eb9ff923413cdb4c7e171c06d3564f6286712`	affected	< 51248d877bbc6e604e38aeaf776c2781cb4f0dbd
`3f4eb9ff923413cdb4c7e171c06d3564f6286712`	affected	< 28743571c17b58c21a7216fc9faaf8028df5869b
`3f4eb9ff923413cdb4c7e171c06d3564f6286712`	affected	< 264ccd7871915749bee55fe0c39467a7f08d5479
`3f4eb9ff923413cdb4c7e171c06d3564f6286712`	affected	< bb7caa63e1db22fd03e8dc591b12169e99169dff

Linux

affected

Version	Status	Constraints
`6.11`	affected	—
`0`	unaffected	< 6.11
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3f4eb9ff923413cdb4c7e171c06d3564f6286712,51248d877bbc6e604e38aeaf776c2781cb4f0dbd)`	affected	code_commit	—
`[3f4eb9ff923413cdb4c7e171c06d3564f6286712,28743571c17b58c21a7216fc9faaf8028df5869b)`	affected	code_commit	—
`[3f4eb9ff923413cdb4c7e171c06d3564f6286712,264ccd7871915749bee55fe0c39467a7f08d5479)`	affected	code_commit	—
`[3f4eb9ff923413cdb4c7e171c06d3564f6286712,bb7caa63e1db22fd03e8dc591b12169e99169dff)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.11`	affected	generic	—
`[0,6.11)`	unaffected	generic	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains the patch commits initializing re_id before removal registration.
If an immediate kernel upgrade is not possible, backport the fix from the listed commits into your current kernel.
If remediation is delayed, consider disabling RDMA device removal or NFS over RDMA to eliminate the race condition.

Generated by OpenCVE AI on August 22, 2026 at 06:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/264ccd7871915749bee55fe0c39467a7f08d5479
https://git.kernel.org/stable/c/28743571c17b58c21a7216fc9faaf8028df5869b
https://git.kernel.org/stable/c/51248d877bbc6e604e38aeaf776c2781cb4f0dbd
https://git.kernel.org/stable/c/bb7caa63e1db22fd03e8dc591b12169e99169dff
https://lore.kernel.org/linux-cve-announce/2026081534-CVE-2026-72468-37e1@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72468
https://www.cve.org/CVERecord?id=CVE-2026-72468

History

Sat, 22 Aug 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-665

Thu, 20 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026081534-CVE-2026-72468-37e1@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72468 https://www.cve.org/CVERecord?id=CVE-2026-72468
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sat, 15 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-665

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re_id before removal registration rpcrdma_create_id() registers ep->re_rn with the rpcrdma ib_client before returning the new rdma_cm_id to rpcrdma_ep_create(). However rpcrdma_ep_create() currently stores that pointer in ep->re_id only after rpcrdma_create_id() returns. A local administrator can race an NFS/RDMA mount against RDMA device removal. If rpcrdma_remove_one() observes the just-registered notification before rpcrdma_ep_create() assigns ep->re_id, rpcrdma_ep_removal_done() calls trace_xprtrdma_device_removal(NULL). The tracepoint dereferences id->device->name and copies id->route.addr.dst_addr, so the callback can crash the kernel with a NULL pointer dereference. Store the rdma_cm_id in ep->re_id immediately before publishing ep->re_rn. The existing error path still destroys the id directly if registration fails; ep is then freed by the caller without using ep->re_id. Remove the later duplicate assignment in rpcrdma_ep_create().
Title		xprtrdma: Initialize re_id before removal registration
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/264ccd7871915749bee55fe0c39467a7f08d5479 https://git.kernel.org/stable/c/28743571c17b58c21a7216fc9faaf8028df5869b https://git.kernel.org/stable/c/51248d877bbc6e604e38aeaf776c2781cb4f0dbd https://git.kernel.org/stable/c/bb7caa63e1db22fd03e8dc591b12169e99169dff

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:57:11.171Z

Updated: 2026-08-17T05:15:13.672Z

Reserved: 2026-08-09T03:40:39.933Z

Link: CVE-2026-72468

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:20.877

Modified: 2026-08-17T06:19:14.683

Link: CVE-2026-72468

Redhat

Severity : Low

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72468 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T06:30:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object