{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72469", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.934Z", "datePublished": "2026-08-15T05:57:11.829Z", "dateUpdated": "2026-08-17T05:44:33.996Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:44:33.996Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Fix ep kref imbalance on ADDR_CHANGE\n\nrpcrdma_cm_event_handler() falls through to the disconnected: label\non RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no\nmatching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED.\nThe kref then underflows during connect teardown and\nrpcrdma_xprt_disconnect() operates on a freed ep.\n\nReference counts across a normal connection lifecycle:\n\n rpcrdma_ep_create() kref_init ->1\n rpcrdma_xprt_connect() ep_get ->2 (before post_recvs)\n RDMA_CM_EVENT_ESTABLISHED ep_get ->3\n RDMA_CM_EVENT_DISCONNECTED ep_put ->2\n rpcrdma_xprt_drain() ep_put ->1\n rpcrdma_xprt_disconnect() tail ep_put ->0 (ep_destroy)\n\nThe connect-time get in rpcrdma_xprt_connect(), taken just before\nrpcrdma_post_recvs() \"while there are outstanding Receives,\" is\nbalanced by rpcrdma_xprt_drain. ADDR_CHANGE before ESTABLISHED has\nno get to consume, so its put drops the count to 1 and the drain\nput then frees the ep while rpcrdma_xprt_disconnect() still holds a\npointer to it.\n\nFix by dispatching on the prior re_connect_status via xchg(): for\nprev == 0 (pre-ESTABLISHED) wake the connect waiter and return with\nno put; for prev == 1 call rpcrdma_force_disconnect() and return.\nThe case-1 arm relies on the subsequent RDMA_CM_EVENT_DISCONNECTED\nevent -- reliably delivered when rdma_disconnect() is called on a\nstill-connected cm_id -- to balance the ESTABLISHED get;\nrpcrdma_xprt_drain() continues to balance only that connect-time\nget. Any other prior value means teardown is already in flight."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is in the NFS/RPC-over-RDMA client reached during RDMA CM connect/reconnect to a remote server; ADDR_CHANGE is delivered on bonded RoCE/IB netdev failover on the storage network segment, a plausible adjacent-network trigger in HPC and cloud NFS-over-RDMA deployments.\nAC:L - Once NFS-over-RDMA is in use, an attacker can reliably drive repeated reconnect attempts and time or induce bonding failover so ADDR_CHANGE arrives pre-ESTABLISHED; the resulting kref underflow and UAF are deterministic, not a probabilistic memory-layout race.\nPR:N - Exploitation requires no privileges on the victim host\u2014only that NFS-over-RDMA is configured and reconnects occur\u2014while an adjacent attacker or malicious storage peer can provoke link failover and connection churn without authenticating to the victim system.\nUI:N - No victim user interaction is required beyond normal automated NFS-over-RDMA client reconnect activity already performed by the kernel when links fail or sessions drop.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - Premature free of rpcrdma_ep leaves dangling pointers used in rpcrdma_xprt_disconnect (rdma_disconnect, ib_drain_rq/sq), a classic kernel heap UAF that can be leveraged for arbitrary memory disclosure via controlled reuse of the freed endpoint object.\nI:H - Teardown continues to operate on the freed endpoint and associated RDMA/IB state, enabling heap corruption and potential arbitrary kernel write or control-flow hijack, not merely a benign NULL dereference crash.\nA:H - The kref imbalance causes premature endpoint destruction during disconnect teardown, which can trigger kernel oops/panic from use-after-free even when exploitation for code execution is not attempted."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/xprtrdma/verbs.c"], "versions": [{"version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec", "lessThan": "cfd1bab66b042da7a778786685125656c695931b", "status": "affected", "versionType": "git"}, {"version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec", "lessThan": "d0479c2b12974aa188b10d221a5770126b118b6d", "status": "affected", "versionType": "git"}, {"version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec", "lessThan": "ffc07790539736a5d029f6a3c966b46c529f93a8", "status": "affected", "versionType": "git"}, {"version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec", "lessThan": "af9b65b29af341932625c4283dc7a23cdb62688a", "status": "affected", "versionType": "git"}, {"version": "2fcbf07a4f23174a45e015b62a8e42ddbc2e53ef", "status": "affected", "versionType": "git"}, {"version": "5.7.9", "lessThan": "5.8", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/xprtrdma/verbs.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cfd1bab66b042da7a778786685125656c695931b"}, {"url": "https://git.kernel.org/stable/c/d0479c2b12974aa188b10d221a5770126b118b6d"}, {"url": "https://git.kernel.org/stable/c/ffc07790539736a5d029f6a3c966b46c529f93a8"}, {"url": "https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a"}], "title": "xprtrdma: Fix ep kref imbalance on ADDR_CHANGE", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sunrpc/xprtrdma/verbs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cfd1bab66b042da7a778786685125656c695931b", "status": "affected", "version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec", "versionType": "git"}, {"lessThan": "d0479c2b12974aa188b10d221a5770126b118b6d", "status": "affected", "version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec", "versionType": "git"}, {"lessThan": "ffc07790539736a5d029f6a3c966b46c529f93a8", "status": "affected", "version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec", "versionType": "git"}, {"lessThan": "af9b65b29af341932625c4283dc7a23cdb62688a", "status": "affected", "version": "2acc5cae292355f5f18ad377a2a966e7f03c8fec", "versionType": "git"}, {"status": "affected", "version": "2fcbf07a4f23174a45e015b62a8e42ddbc2e53ef", "versionType": "git"}, {"lessThan": "5.8", "status": "affected", "version": "5.7.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sunrpc/xprtrdma/verbs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Fix ep kref imbalance on ADDR_CHANGE\n\nrpcrdma_cm_event_handler() falls through to the disconnected: label\non RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no\nmatching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED.\nThe kref then underflows during connect teardown and\nrpcrdma_xprt_disconnect() operates on a freed ep.\n\nReference counts across a normal connection lifecycle:\n\n rpcrdma_ep_create() kref_init ->1\n rpcrdma_xprt_connect() ep_get ->2 (before post_recvs)\n RDMA_CM_EVENT_ESTABLISHED ep_get ->3\n RDMA_CM_EVENT_DISCONNECTED ep_put ->2\n rpcrdma_xprt_drain() ep_put ->1\n rpcrdma_xprt_disconnect() tail ep_put ->0 (ep_destroy)\n\nThe connect-time get in rpcrdma_xprt_connect(), taken just before\nrpcrdma_post_recvs() \"while there are outstanding Receives,\" is\nbalanced by rpcrdma_xprt_drain. ADDR_CHANGE before ESTABLISHED has\nno get to consume, so its put drops the count to 1 and the drain\nput then frees the ep while rpcrdma_xprt_disconnect() still holds a\npointer to it.\n\nFix by dispatching on the prior re_connect_status via xchg(): for\nprev == 0 (pre-ESTABLISHED) wake the connect waiter and return with\nno put; for prev == 1 call rpcrdma_force_disconnect() and return.\nThe case-1 arm relies on the subsequent RDMA_CM_EVENT_DISCONNECTED\nevent -- reliably delivered when rdma_disconnect() is called on a\nstill-connected cm_id -- to balance the ESTABLISHED get;\nrpcrdma_xprt_drain() continues to balance only that connect-time\nget. Any other prior value means teardown is already in flight."}], "id": "CVE-2026-72469", "lastModified": "2026-08-17T06:19:14.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:20.997", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cfd1bab66b042da7a778786685125656c695931b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0479c2b12974aa188b10d221a5770126b118b6d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ffc07790539736a5d029f6a3c966b46c529f93a8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE", "id": "2516389", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516389"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxprtrdma: Fix ep kref imbalance on ADDR_CHANGE\nrpcrdma_cm_event_handler() falls through to the disconnected: label\non RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no\nmatching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED.\nThe kref then underflows during connect teardown and\nrpcrdma_xprt_disconnect() operates on a freed ep.\nReference counts across a normal connection lifecycle:\nrpcrdma_ep_create() kref_init ->1\nrpcrdma_xprt_connect() ep_get ->2 (before post_recvs)\nRDMA_CM_EVENT_ESTABLISHED ep_get ->3\nRDMA_CM_EVENT_DISCONNECTED ep_put ->2\nrpcrdma_xprt_drain() ep_put ->1\nrpcrdma_xprt_disconnect() tail ep_put ->0 (ep_destroy)\nThe connect-time get in rpcrdma_xprt_connect(), taken just before\nrpcrdma_post_recvs() \"while there are outstanding Receives,\" is\nbalanced by rpcrdma_xprt_drain. ADDR_CHANGE before ESTABLISHED has\nno get to consume, so its put drops the count to 1 and the drain\nput then frees the ep while rpcrdma_xprt_disconnect() still holds a\npointer to it.\nFix by dispatching on the prior re_connect_status via xchg(): for\nprev == 0 (pre-ESTABLISHED) wake the connect waiter and return with\nno put; for prev == 1 call rpcrdma_force_disconnect() and return.\nThe case-1 arm relies on the subsequent RDMA_CM_EVENT_DISCONNECTED\nevent -- reliably delivered when rdma_disconnect() is called on a\nstill-connected cm_id -- to balance the ESTABLISHED get;\nrpcrdma_xprt_drain() continues to balance only that connect-time\nget. Any other prior value means teardown is already in flight.", "A flaw was found in the xprtrdma component of the Linux kernel. An attacker could potentially exploit a use-after-free vulnerability due to an improper handling of Remote Direct Memory Access (RDMA) connection events. Specifically, an address change event occurring before a connection is fully established can lead to an imbalance in reference counting, causing the system to attempt to use memory that has already been released. This could result in system instability or crashes."], "name": "CVE-2026-72469", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72469\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72469\nhttps://lore.kernel.org/linux-cve-announce/2026081534-CVE-2026-72469-f199@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2acc5cae292355f5f18ad377a2a966e7f03c8fec,cfd1bab66b042da7a778786685125656c695931b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2acc5cae292355f5f18ad377a2a966e7f03c8fec,d0479c2b12974aa188b10d221a5770126b118b6d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2acc5cae292355f5f18ad377a2a966e7f03c8fec,ffc07790539736a5d029f6a3c966b46c529f93a8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2acc5cae292355f5f18ad377a2a966e7f03c8fec,af9b65b29af341932625c4283dc7a23cdb62688a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "2fcbf07a4f23174a45e015b62a8e42ddbc2e53ef"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.7.9,5.8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "7.2-rc1"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T12:30:07.845185+00:00", "updated": "2026-08-22T04:45:03.427198+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}