{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72317","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.919Z","datePublished":"2026-08-15T05:55:31.022Z","dateUpdated":"2026-08-17T05:42:43.024Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:42:43.024Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: pin upper rpc_clnt across the TLS connect_worker\n\nThe TLS connect path has a use-after-free: nothing pins the\nupper rpc_clnt across the delayed connect_worker. xs_connect()\nstores task->tk_client in sock_xprt::clnt as a raw pointer\nand queues the worker; for TLS-secured transports that worker\nis xs_tcp_tls_setup_socket(), which reads several fields out\nof the saved pointer (cl_timeout, cl_program, cl_prog,\ncl_vers, cl_cred, cl_stats) to construct the args for the\ninner handshake rpc_clnt.\n\nThe xprt does not reference the rpc_clnt; the rpc_clnt\nreferences the xprt. xs_destroy() does cancel the\nconnect_worker, but it runs only when the xprt's refcount\ndrops to zero, which cannot happen until the rpc_clnt\nreleases its cl_xprt reference in rpc_free_client_work().\nWhen a TLS handshake fails fatally (for example, an mTLS\nmount whose client cert does not match the server), the\nconnecting task is woken with -EACCES and exits, the mount\ncaller invokes rpc_shutdown_client(), and the upper rpc_clnt\nis freed before the queued connect_worker fires.\nxs_tcp_tls_setup_socket() then dereferences the freed clnt,\nproducing the refcount_t underflow Michael Nemanov reported.\n\nTake a reference on the upper rpc_clnt in xs_connect() for\nTLS transports via a new rpc_hold_client() helper, and drop\nit in the connect_worker's exit path with rpc_release_client().\nThe xprt_lock_connect() / xprt_unlock_connect() pairing\nalready serialises xs_connect() with xs_tcp_tls_setup_socket(),\nso the take and release are balanced one-for-one.\n\nThe non-TLS connect worker (xs_tcp_setup_socket) never reads\nsock_xprt::clnt, so leave that path alone and avoid the\nclnt-holds-xprt-holds-clnt cycle that would otherwise prevent\nxprt destruction."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in the SUNRPC TCP-with-TLS client connect_worker processing a remote NFS server's TLS handshake; a malicious or misconfigured server can induce fatal handshake failure over the network before the delayed worker runs, matching network-reachable kTLS/RPC-with-TLS client paths.\nAC:L - An attacker operating a reachable NFS endpoint can reliably cause fatal TLS handshake failure (e.g., reject mTLS client certificates or send TLS alerts) and influence reconnect timing/backoff so client teardown frees rpc_clnt before the queued connect_worker executes.\nPR:N - Exploitation requires no privileges on the victim host; a remote peer only needs the client kernel to initiate or re-establish an NFS RPC-with-TLS connection, and TLS handshake processing occurs before NFS authentication completes.\nUI:N - No further victim action is needed once an NFS xprtsec=tls/mtls mount exists because automatic reconnect after server-induced disconnect or handshake failure can trigger the race without additional user interaction.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is standard local kernel compromise rather than crossing VM, container, or IOMMU security scopes.\nC:H - This is a kernel heap use-after-free where xs_tcp_tls_setup_socket reads multiple fields from a freed rpc_clnt (including cl_cred and cl_program), enabling information disclosure and further exploitation beyond a simple crash.\nI:H - Use-after-free of rpc_clnt permits corrupting allocator metadata and adjacent kernel objects; freed-object reuse can yield arbitrary write or control-flow hijack primitives, not merely authenticated data alteration.\nA:H - Accessing the freed rpc_clnt produces a refcount_t underflow and kernel oops/panic; even unsuccessful exploitation typically crashes or hangs the system, and repeated reconnect attempts can deny availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/sunrpc/clnt.h","net/sunrpc/clnt.c","net/sunrpc/xprtsock.c"],"versions":[{"version":"75eb6af7acdf566c68d61e98e67ee2f235201c02","lessThan":"79cd550f8c884523b604fbfa43eb02def74d6224","status":"affected","versionType":"git"},{"version":"75eb6af7acdf566c68d61e98e67ee2f235201c02","lessThan":"7a65b41b657b71d5a77861f47dd13eb4bc8e10d0","status":"affected","versionType":"git"},{"version":"75eb6af7acdf566c68d61e98e67ee2f235201c02","lessThan":"5b0427ba582d143a364301f825f4e32272f06d2d","status":"affected","versionType":"git"},{"version":"75eb6af7acdf566c68d61e98e67ee2f235201c02","lessThan":"d49f6d098ed48775b9d27a9f9c5c220fdf76f102","status":"affected","versionType":"git"},{"version":"75eb6af7acdf566c68d61e98e67ee2f235201c02","lessThan":"46bc86c833956219bbfd246c1ffd832a479c5199","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/sunrpc/clnt.h","net/sunrpc/clnt.c","net/sunrpc/xprtsock.c"],"versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/79cd550f8c884523b604fbfa43eb02def74d6224"},{"url":"https://git.kernel.org/stable/c/7a65b41b657b71d5a77861f47dd13eb4bc8e10d0"},{"url":"https://git.kernel.org/stable/c/5b0427ba582d143a364301f825f4e32272f06d2d"},{"url":"https://git.kernel.org/stable/c/d49f6d098ed48775b9d27a9f9c5c220fdf76f102"},{"url":"https://git.kernel.org/stable/c/46bc86c833956219bbfd246c1ffd832a479c5199"}],"title":"SUNRPC: pin upper rpc_clnt across the TLS connect_worker","x_generator":{"engine":"bippy-1.2.0"}}}}