CVE-2026-72220

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: harden rq_procinfo lifecycle to prevent double-free

The svc_release_rqst() function executes the callback inside

rqstp->rq_procinfo->pc_release. However, if a worker thread begins

processing a new request and encounters an early error path (e.g.,

unsupported protocol, short frame, or bad auth) before a valid

rq_procinfo is installed, a stale release hook can be re-triggered

against reused state from the previous RPC, resulting in a double-free

or use-after-free vulnerability.

Harden the lifecycle of rq_procinfo by:

1. Ensuring svc_release_rqst() always clears rq_procinfo after the

optional pc_release() call, regardless of whether the hook exists.

2. Explicitly clearing rq_procinfo at request entry in svc_process()

before any early decode or drop paths.

3. Ensuring svc_process_bc() does the same at backchannel entry.

This guarantees that error flows will not encounter a non-NULL stale

rq_procinfo point

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References