Skip to main content

Linux Kernel xprtrdma EUVDEUVD-2026-59364

| CVE-2026-72465 HIGH
2026-08-15 Linux GHSA-qhx3-pwwp-v2cp
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

RDMA fabric requires adjacent network access, not arbitrary internet reachability, making AV:A more accurate than NVD's AV:N; no auth or interaction needed once on fabric.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:37 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.5 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
HIGH 7.5
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: Sanitize the reply credit grant after parsing

The out_norqst exit in rpcrdma_reply_handler() branches away before the credit clamp, so a reply that matches no pending request reaches out_post carrying the raw credit value parsed from the wire. rpcrdma_post_recvs() does not bound its @needed argument: the refill loop allocates and chains Receive WRs until the count is satisfied or allocation fails. A peer that sends a well-formed reply carrying an unknown XID and an inflated credit grant therefore drives rep allocation and Receive posting past re_max_requests on every such reply.

Move the clamp to immediately after the credit field is parsed, ahead of the first branch that can reach out_post, so every later consumer sees a sanitized value. The cwnd update stays on the matched-request path.

AnalysisAI

Resource exhaustion in the Linux kernel's xprtrdma (RDMA transport for NFS/RPC) subsystem allows a malicious or compromised RDMA peer to trigger unbounded Receive Work Request allocation, causing denial of service on affected systems. The flaw exists in rpcrdma_reply_handler(), where the credit clamp is bypassed for replies matching no pending request (unknown XID), and rpcrdma_post_recvs() then allocates WRs past re_max_requests without bound. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), reflecting the niche RDMA deployment context. Patches are available across multiple stable kernel branches.

Technical ContextAI

The xprtrdma subsystem implements RDMA (Remote Direct Memory Access) as a transport for Linux NFS/RPC clients, typically over InfiniBand, RoCE (RDMA over Converged Ethernet), or iWARP fabrics. RDMA transports use credit-based flow control: the peer advertises how many Receive Work Requests (WRs) the local side may post. In rpcrdma_reply_handler(), when a received reply carries an XID that matches no pending RPC call, execution follows the out_norqst branch - bypassing the credit clamp that normally constrains the parsed grant value to re_max_requests. The raw, peer-controlled credit value then reaches rpcrdma_post_recvs(), which uses it as the @needed argument in a refill loop that allocates and chains Receive WRs until the count is satisfied or allocation fails. The fix moves the clamp to immediately after credit field parsing, ahead of any branch that reaches out_post, so all consumers see a sanitized value. CPE indicates the affected product is linux:linux across multiple version ranges. No CWE has been formally assigned, but the root cause is an improper input validation / missing bounds check on a wire-protocol field (CWE-20 or CWE-770 pattern).

RemediationAI

Apply the vendor-released stable kernel patches corresponding to your branch. Patched versions confirmed by EUVD include Linux 7.1.5 (stable series) and Linux 7.2-rc1 (mainline). Commit-level fixes are available at https://git.kernel.org/stable/c/7cf332b3d82d73ffceedca6b4a120be074172021, https://git.kernel.org/stable/c/41634242140173eabbf54f899f9c70b5c685e786, https://git.kernel.org/stable/c/8be1bb378def94a5cb8f7527a191e476407118ec, https://git.kernel.org/stable/c/469b22376ee73369711ecf2761bd122ef4195963, https://git.kernel.org/stable/c/33db78b1b24fc6a464ae08aa4d2538c5f883eb5e, and https://git.kernel.org/stable/c/c3a628aab2dc8f5fd7bff86ceaeae64de590e60a. If patching is not immediately possible, a targeted compensating control is to mount NFS shares using TCP transport instead of RDMA (mount option proto=tcp), which disables xprtrdma entirely and eliminates the attack surface with no confidentiality or integrity trade-off - only potential throughput reduction for high-bandwidth NFS workloads. Alternatively, enforce strict RDMA fabric ACLs (InfiniBand partitioning / RoCE VLAN isolation) to ensure only trusted NFS servers can communicate with clients over RDMA, limiting the set of peers that could send crafted replies.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-59364 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy