Skip to main content

Linux Kernel CVE-2026-72217

| EUVDEUVD-2026-58975 CRITICAL
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-jffc-255g-3gq9
Buffer Overflow Linux Red Hat Suse
9.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

Network-reachable via nfsd with typically no real auth (PR:N), but requires exact rq_bvec budget exhaustion and heap grooming for impact beyond a crash (AC:H); kernel corruption gives high C/I/A.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:43 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing

xdr_buf_to_bvec() writes a bio_vec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the caller's budget is exactly used up, the next store lands one element past the end of the array. The overflow label returns count - 1, which masks the surplus store but cannot undo it.

rq_bvec, the array passed by nfsd_vfs_write(), is allocated to exactly rq_maxpages entries with no slack. The OOB store can land in adjacent slab memory; the bv_len and bv_offset fields written there are derived from client-supplied RPC payload sizes.

Move the in-range check ahead of the store in the head, page-loop, and tail branches. With the check at the top of each sequence, count is incremented only after a successful store, so the overflow label can return count directly.

AnalysisAI

Out-of-bounds slab write in the Linux kernel SUNRPC layer (xdr_buf_to_bvec()) lets a remote NFS client corrupt kernel memory via the in-kernel NFS server (nfsd) write path. The function stores a bio_vec into the caller's rq_bvec array before verifying the slot is in range - and the head branch stores with no check at all - so when the exactly-sized rq_maxpages budget is used up, one bio_vec lands past the array into adjacent slab memory, with attacker-influenced bv_len and bv_offset values taken from client-supplied RPC payload sizes. Rated CVSS 9.8 by the source, but with low EPSS (0.21%), no CISA KEV listing, and no public exploit identified at time of analysis.

Technical ContextAI

The flaw is in the kernel's SUNRPC transport code that backs NFSD (the in-kernel NFS server). xdr_buf_to_bvec() converts an XDR buffer (RPC-encoded data split into a head, a list of pages, and a tail) into an array of bio_vec structures for I/O. The caller nfsd_vfs_write() allocates rq_bvec with exactly rq_maxpages entries and no slack. The root cause is a classic off-by-one / out-of-bounds write (CWE-787, CWE-193): the range check was performed after the store rather than before it, and the head branch omitted the check entirely, so the count is incremented and used before validation. The overflowing bio_vec's bv_len and bv_offset are derived from client-controlled RPC payload sizes, meaning an attacker has partial influence over the values written into neighboring slab objects. The fix moves the in-range check ahead of the store in the head, page-loop, and tail branches so count advances only after a successful store. CWE was reported as N/A in the feed but the behavior is unambiguously an out-of-bounds write.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 (or later in each series), matching your running branch, or take your distribution's backported update once available. The upstream fix is available as the git.kernel.org commits listed above (e.g. 6029e711a818bf34d6c4b90cafee24f3afffa110). Where immediate patching is not possible, the most effective compensating control is to reduce the attack surface of the NFS server: stop and disable nfsd on hosts that do not need to export filesystems (side effect: NFS sharing is lost), and for hosts that must serve NFS, restrict which clients can reach the service and mount writable exports - firewall TCP/UDP 2049 (and rpcbind/mountd ports) to trusted client subnets only, and tighten /etc/exports to specific host lists and read-only where write access is not required (side effect: legitimate write clients removed by these restrictions will fail). These controls limit who can reach the vulnerable write path but do not fix the underlying OOB write, so patching remains the priority. Advisory reference: https://nvd.nist.gov/vuln/detail/CVE-2026-72217.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72217 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy