{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72220","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.913Z","datePublished":"2026-08-15T05:54:13.800Z","dateUpdated":"2026-08-17T05:41:41.598Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:41:41.598Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: harden rq_procinfo lifecycle to prevent double-free\n\nThe svc_release_rqst() function executes the callback inside\nrqstp->rq_procinfo->pc_release. However, if a worker thread begins\nprocessing a new request and encounters an early error path (e.g.,\nunsupported protocol, short frame, or bad auth) before a valid\nrq_procinfo is installed, a stale release hook can be re-triggered\nagainst reused state from the previous RPC, resulting in a double-free\nor use-after-free vulnerability.\n\nHarden the lifecycle of rq_procinfo by:\n1. Ensuring svc_release_rqst() always clears rq_procinfo after the\n   optional pc_release() call, regardless of whether the hook exists.\n2. Explicitly clearing rq_procinfo at request entry in svc_process()\n   before any early decode or drop paths.\n3. Ensuring svc_process_bc() does the same at backchannel entry.\n\nThis guarantees that error flows will not encounter a non-NULL stale\nrq_procinfo pointer when there is nothing to release."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in server-side SUNRPC request handling reached from remote RPC over TCP/UDP/RDMA transports used by nfsd and lockd (svc_recv→svc_handle_xprt→svc_process), exploitable by sending crafted ONC/RPC packets to listening NFS/NLM ports.\nAC:L - An attacker controls the RPC sequence and timing (valid request then malformed/short/bad-auth/bad-prog packet on the same pooled worker) to reliably re-trigger a stale pc_release without depending on uncontrollable layout or victim state.\nPR:N - Trigger paths include pre-authentication failures (garbage credentials, unknown program/version, short frames) that still call svc_release_rqst; stale rq_procinfo can be left by any prior RPC on the same worker, so no attacker credentials are required.\nUI:N - Exploitation requires only network RPC traffic to an already-running NFS/NLM server; no end-user actions such as mounting a share or opening files are needed beyond normal server exposure.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel context; it does not inherently cross a VM, container, or IOMMU security boundary to another authority.\nC:H - The bug is an explicit double-free/use-after-free of per-request NFS release state (e.g. nfsd4_release_compoundargs kfree/vfree chains and fh_put paths), enabling arbitrary kernel memory disclosure when exploited.\nI:H - Re-invoking pc_release on reused svc_rqst buffers corrupts heap metadata and object lifetimes, providing a standard kernel double-free/UAF primitive suitable for arbitrary write and code execution.\nA:H - Repeated or mistimed pc_release calls can immediately panic the kernel via SLUB double-free detection, oops, or wedged nfsd worker threads, causing complete loss of availability on NFS-serving systems."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/svc.c"],"versions":[{"version":"d9adbb6e10bf7d4223d3d521ede1b2052903bc5e","lessThan":"66014ab165cb01bfef5836939412a8ef98d5d5ff","status":"affected","versionType":"git"},{"version":"d9adbb6e10bf7d4223d3d521ede1b2052903bc5e","lessThan":"31ba490c02d476a5e4f90b8845932ac9db8aa71b","status":"affected","versionType":"git"},{"version":"d9adbb6e10bf7d4223d3d521ede1b2052903bc5e","lessThan":"18d216788bef06332ff8901670ecf1ed8f6eb614","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/svc.c"],"versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/66014ab165cb01bfef5836939412a8ef98d5d5ff"},{"url":"https://git.kernel.org/stable/c/31ba490c02d476a5e4f90b8845932ac9db8aa71b"},{"url":"https://git.kernel.org/stable/c/18d216788bef06332ff8901670ecf1ed8f6eb614"}],"title":"sunrpc: harden rq_procinfo lifecycle to prevent double-free","x_generator":{"engine":"bippy-1.2.0"}}}}