Skip to main content

Linux Kernel EUVDEUVD-2026-59119

| CVE-2026-72220 CRITICAL
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-m4wq-7wv4-xpq8
Information Disclosure Linux Red Hat Suse
9.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

Remotely reachable via an exposed RPC server so AV:N/PR:N, but success depends on winning a non-deterministic reuse race, so AC:H; kernel memory corruption can yield full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:44 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: harden rq_procinfo lifecycle to prevent double-free

The svc_release_rqst() function executes the callback inside rqstp->rq_procinfo->pc_release. However, if a worker thread begins processing a new request and encounters an early error path (e.g., unsupported protocol, short frame, or bad auth) before a valid rq_procinfo is installed, a stale release hook can be re-triggered against reused state from the previous RPC, resulting in a double-free or use-after-free vulnerability.

Harden the lifecycle of rq_procinfo by:

  1. Ensuring svc_release_rqst() always clears rq_procinfo after the

optional pc_release() call, regardless of whether the hook exists.

  1. Explicitly clearing rq_procinfo at request entry in svc_process()

before any early decode or drop paths.

  1. Ensuring svc_process_bc() does the same at backchannel entry.

This guarantees that error flows will not encounter a non-NULL stale rq_procinfo pointer when there is nothing to release.

AnalysisAI

Memory-corruption (double-free / use-after-free) in the Linux kernel's SunRPC server layer allows the rq_procinfo->pc_release hook to fire against stale, reused request state when a worker thread hits an early error path (unsupported protocol, short frame, or bad auth) before a valid procinfo is installed. It affects Linux 6.18 (and the shared SunRPC code reachable via kernel RPC servers such as nfsd), and successful triggering corrupts kernel heap state, risking denial of service or privilege escalation. The issue is patched upstream; there is no public exploit identified at time of analysis and EPSS is low (0.21%), so it is not currently known to be exploited.

Technical ContextAI

The affected component is the kernel's SunRPC server implementation (net/sunrpc), which underpins RPC-based services most notably the in-kernel NFS server (nfsd) and its backchannel. Each request structure (svc_rqst) carries an rq_procinfo pointer describing the RPC procedure, including an optional pc_release() cleanup callback invoked by svc_release_rqst(). The root cause is a lifecycle/ownership bug: rq_procinfo was not reliably cleared, so a release hook belonging to a previously handled RPC could be re-invoked over reused state, freeing an object twice or dereferencing freed memory. This is a classic use-after-free/double-free (CWE-415/CWE-416 class, though the feed lists CWE as N/A) stemming from stale pointer reuse across request boundaries. The fix clears rq_procinfo after any pc_release() call and explicitly nulls it at request entry in svc_process() and at backchannel entry in svc_process_bc(), so error paths never see a non-NULL stale pointer.

RemediationAI

Vendor-released patch: update to a fixed Linux kernel build - 6.18.40 or later on the 6.18 stable line, or 7.1.5 / 7.2-rc1 on newer lines - via your distribution's kernel package (the upstream commits are 66014ab165cb01bfef5836939412a8ef98d5d5ff, 31ba490c02d476a5e4f90b8845932ac9db8aa71b, and 18d216788bef06332ff8901670ecf1ed8f6eb614). Reboot to activate the new kernel or apply the equivalent livepatch if your vendor ships one. Where immediate patching is not possible, reduce exposure by restricting reachability of in-kernel RPC services: stop/disable nfsd where it is not required, and firewall the RPC/NFS ports (111/2049 and rpcbind) to trusted management networks only - the trade-off is loss of NFS export/mount availability to blocked clients, so scope the rules to hosts that genuinely serve those clients. There is no application-level workaround inside the kernel itself, so network isolation and prompt kernel upgrade are the effective controls. Advisory/reference: https://nvd.nist.gov/vuln/detail/CVE-2026-72220.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-59119 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy