CVE-2026-72473 - Vulnerability Details

- xprtrdma: Decouple req recycling from RPC completion

Description

In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: Decouple req recycling from RPC completion

rl_kref formerly served two distinct lifetimes through a single
refcount: it gated when a Reply could wake its RPC task, and it
gated when an rpcrdma_req could return to its free pool. The
marshal path took the Send-side reference only when SGEs needed
DMA-unmap (sc_unmap_count > 0), which made a Send carrying only
pre-registered buffers an exception: the Reply handler dropped
rl_kref from 1 to 0 and freed the req while the HCA might still
be DMA-reading from its send buffer.

Give rl_kref a narrower job. The RPC layer takes one reference
when slot allocation hands a req out. rpcrdma_prepare_send_sges()
takes a Send-side reference unconditionally after WR preparation
succeeds. xprt_rdma_free_slot() and xprt_rdma_bc_free_rqst() drop
the RPC-layer reference; rpcrdma_sendctx_unmap() drops the
Send-side reference. The req returns to its free pool only after
both owners have signed off.

The existing kref_init(&req->rl_kref) call in
rpcrdma_prepare_send_sges() is removed. Initialization moves to
the slot-allocation paths (xprt_rdma_alloc_slot and
rpcrdma_bc_rqst_get), and the release callback re-arms rl_kref
before the req returns to a free pool. A re-init in the marshal
path would discard the RPC-layer reference that already exists
on entry.

Three invariants follow:

- Any rpcrdma_req held by an rpc_rqst has rl_kref >= 1.
xprt_rdma_alloc_slot(), rpcrdma_bc_rqst_get(), and the
backlog-wake branch in xprt_rdma_alloc_slot() each kref_init
rl_kref before publishing the req. Without this invariant,
an RPC task that aborts between slot allocation and marshal
(gss_refresh failure or signal during call_connect, for
example) would drive xprt_release() ->
xprt_rdma_free_slot() -> kref_put against a refcount of
zero, saturating refcount_t and stranding the slot.

- The Send-side reference is taken only after WR prep
succeeds. A mapping failure in rpcrdma_prepare_send_sges()
runs rpcrdma_sendctx_cancel(), which DMA-unmaps the sendctx
and clears sc_req without touching rl_kref. The sendctx
ring walks in rpcrdma_sendctx_put_locked() and
rpcrdma_sendctxs_destroy() skip entries with sc_req == NULL,
so a burst of -EIO marshal failures cannot hold reqs off
rb_send_bufs.

- The release callback re-arms rl_kref so the next consumer
enters with the invariant satisfied.

Replies now complete the RPC directly. rpcrdma_reply_handler()
calls rpcrdma_complete_rqst() in place of kref_put on the
non-LocalInv branch. The LocalInv branch already completes the
RPC from frwr_unmap_async() and is unaffected.

Because Send-side references can now outlive RPC completion,
connection teardown drains sendctx entries whose unsignaled
Sends never had a later signaled completion to walk the ring.
rpcrdma_sendctxs_destroy() walks the active range and runs
rpcrdma_sendctx_unmap() on each entry with a non-NULL sc_req
before the request buffers are reset, and is moved ahead of
rpcrdma_reqs_reset() in rpcrdma_xprt_disconnect() so the reqs
are still in their pre-reset state when the Send-side refs are
released.

The drain creates a teardown-ordering hazard on the backchannel
path. With the new lifetime, releasing a bc_prealloc req from
rpcrdma_req_release() re-adds it to bc_pa_list. The disconnect
in xprt_rdma_destroy() runs after xprt_destroy_backchannel() has
already emptied bc_pa_list, so the drained reqs would otherwise
leak. xprt_rdma_destroy() now runs xprt_rdma_bc_destroy(xprt, 0)
a second time after the disconnect to reclaim them.

Published: 2026-08-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s xprtrdma RDMA subsystem, the reference counter for request structures was incorrectly handled, allowing a request to be freed while RDMA hardware was still accessing its buffers. This race condition results in a use-after-free that can corrupt kernel memory and cause a crash, effectively denying service to all processes on the host. The weakness falls under use-after-free and race conditions (CWE-911).

Affected Systems

All Linux kernels that include the xprtrdma subsystem before the patch described in the advisory are vulnerable. Kernel versions shipping this commit have corrected the reference‑counting logic. Distribution security‑patched releases that have not yet incorporated the commit remain at risk and should be updated.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.8 and an EPSS score of less than 1 %, indicating a critical flaw that is rarely exploited in the wild. It is not listed in CISA’s KEV catalog. The attack vector is inferred to be an RDMA client that can send traffic to the target; a local privileged user or a remote attacker with RDMA access can trigger the race by rapidly issuing sends and waiting for their completion, leading to a kernel crash and system downtime.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0ab115237025f5e379620bbcd56a02697d07b002`	affected	< 740975054a1970c0cf15f70ac39724a064f45847
`0ab115237025f5e379620bbcd56a02697d07b002`	affected	< 9f3d9b68c1c6c51746e5ecdb52b2e6a2901de37e
`0ab115237025f5e379620bbcd56a02697d07b002`	affected	< e7632089523acddcdd8f090ad19e96fb3107b04d
`0ab115237025f5e379620bbcd56a02697d07b002`	affected	< 53442c7d0c888e51b8bc3da196970a669cc6b294
`0ab115237025f5e379620bbcd56a02697d07b002`	affected	< 8203f760a72bd39a3b66bc4eff0aa272a99fe22b
`0ab115237025f5e379620bbcd56a02697d07b002`	affected	< e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3

Linux

affected

Version	Status	Constraints
`5.3`	affected	—
`0`	unaffected	< 5.3
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0ab115237025f5e379620bbcd56a02697d07b002,740975054a1970c0cf15f70ac39724a064f45847)`	affected	code_commit	—
`[0ab115237025f5e379620bbcd56a02697d07b002,9f3d9b68c1c6c51746e5ecdb52b2e6a2901de37e)`	affected	code_commit	—
`[0ab115237025f5e379620bbcd56a02697d07b002,e7632089523acddcdd8f090ad19e96fb3107b04d)`	affected	code_commit	—
`[0ab115237025f5e379620bbcd56a02697d07b002,53442c7d0c888e51b8bc3da196970a669cc6b294)`	affected	code_commit	—
`[0ab115237025f5e379620bbcd56a02697d07b002,8203f760a72bd39a3b66bc4eff0aa272a99fe22b)`	affected	code_commit	—
`[0ab115237025f5e379620bbcd56a02697d07b002,e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.3`	affected	generic	—
`[0,5.3)`	unaffected	generic	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that incorporates the corrected xprtrdma reference‑count handling.
If a kernel upgrade cannot be performed immediately, disable or restrict the RDMA subsystem by unloading the rpcrdma modules or limiting RDMA traffic to trusted hosts.
Monitor kernel logs for PMU or DMA‑related errors and enable hardening features such as SMEP, SMAP, or KASLR to reduce the impact of any attempted exploit.

Generated by OpenCVE AI on August 22, 2026 at 04:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00664.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/53442c7d0c888e51b8bc3da196970a669cc6b294
https://git.kernel.org/stable/c/740975054a1970c0cf15f70ac39724a064f45847
https://git.kernel.org/stable/c/8203f760a72bd39a3b66bc4eff0aa272a99fe22b
https://git.kernel.org/stable/c/9f3d9b68c1c6c51746e5ecdb52b2e6a2901de37e
https://git.kernel.org/stable/c/e7632089523acddcdd8f090ad19e96fb3107b04d
https://git.kernel.org/stable/c/e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3
https://lore.kernel.org/linux-cve-announce/2026081535-CVE-2026-72473-0181@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72473
https://www.cve.org/CVERecord?id=CVE-2026-72473

History

Sat, 22 Aug 2026 03:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 20 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026081535-CVE-2026-72473-0181@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72473 https://www.cve.org/CVERecord?id=CVE-2026-72473
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 17 Aug 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rl_kref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdma_req could return to its free pool. The marshal path took the Send-side reference only when SGEs needed DMA-unmap (sc_unmap_count > 0), which made a Send carrying only pre-registered buffers an exception: the Reply handler dropped rl_kref from 1 to 0 and freed the req while the HCA might still be DMA-reading from its send buffer. Give rl_kref a narrower job. The RPC layer takes one reference when slot allocation hands a req out. rpcrdma_prepare_send_sges() takes a Send-side reference unconditionally after WR preparation succeeds. xprt_rdma_free_slot() and xprt_rdma_bc_free_rqst() drop the RPC-layer reference; rpcrdma_sendctx_unmap() drops the Send-side reference. The req returns to its free pool only after both owners have signed off. The existing kref_init(&req->rl_kref) call in rpcrdma_prepare_send_sges() is removed. Initialization moves to the slot-allocation paths (xprt_rdma_alloc_slot and rpcrdma_bc_rqst_get), and the release callback re-arms rl_kref before the req returns to a free pool. A re-init in the marshal path would discard the RPC-layer reference that already exists on entry. Three invariants follow: - Any rpcrdma_req held by an rpc_rqst has rl_kref >= 1. xprt_rdma_alloc_slot(), rpcrdma_bc_rqst_get(), and the backlog-wake branch in xprt_rdma_alloc_slot() each kref_init rl_kref before publishing the req. Without this invariant, an RPC task that aborts between slot allocation and marshal (gss_refresh failure or signal during call_connect, for example) would drive xprt_release() -> xprt_rdma_free_slot() -> kref_put against a refcount of zero, saturating refcount_t and stranding the slot. - The Send-side reference is taken only after WR prep succeeds. A mapping failure in rpcrdma_prepare_send_sges() runs rpcrdma_sendctx_cancel(), which DMA-unmaps the sendctx and clears sc_req without touching rl_kref. The sendctx ring walks in rpcrdma_sendctx_put_locked() and rpcrdma_sendctxs_destroy() skip entries with sc_req == NULL, so a burst of -EIO marshal failures cannot hold reqs off rb_send_bufs. - The release callback re-arms rl_kref so the next consumer enters with the invariant satisfied. Replies now complete the RPC directly. rpcrdma_reply_handler() calls rpcrdma_complete_rqst() in place of kref_put on the non-LocalInv branch. The LocalInv branch already completes the RPC from frwr_unmap_async() and is unaffected. Because Send-side references can now outlive RPC completion, connection teardown drains sendctx entries whose unsignaled Sends never had a later signaled completion to walk the ring. rpcrdma_sendctxs_destroy() walks the active range and runs rpcrdma_sendctx_unmap() on each entry with a non-NULL sc_req before the request buffers are reset, and is moved ahead of rpcrdma_reqs_reset() in rpcrdma_xprt_disconnect() so the reqs are still in their pre-reset state when the Send-side refs are released. The drain creates a teardown-ordering hazard on the backchannel path. With the new lifetime, releasing a bc_prealloc req from rpcrdma_req_release() re-adds it to bc_pa_list. The disconnect in xprt_rdma_destroy() runs after xprt_destroy_backchannel() has already emptied bc_pa_list, so the drained reqs would otherwise leak. xprt_rdma_destroy() now runs xprt_rdma_bc_destroy(xprt, 0) a second time after the disconnect to reclaim them.
Title		xprtrdma: Decouple req recycling from RPC completion
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/53442c7d0c888e51b8bc3da196970a669cc6b294 https://git.kernel.org/stable/c/740975054a1970c0cf15f70ac39724a064f45847 https://git.kernel.org/stable/c/8203f760a72bd39a3b66bc4eff0aa272a99fe22b https://git.kernel.org/stable/c/9f3d9b68c1c6c51746e5ecdb52b2e6a2901de37e https://git.kernel.org/stable/c/e7632089523acddcdd8f090ad19e96fb3107b04d https://git.kernel.org/stable/c/e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:57:14.412Z

Updated: 2026-08-17T05:44:39.513Z

Reserved: 2026-08-09T03:40:39.934Z

Link: CVE-2026-72473

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:21.423

Modified: 2026-08-17T06:19:15.273

Link: CVE-2026-72473

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72473 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T04:45:03Z

Weaknesses

CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object