CVE-2026-72317

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: pin upper rpc_clnt across the TLS connect_worker

The TLS connect path has a use-after-free: nothing pins the

upper rpc_clnt across the delayed connect_worker. xs_connect()

stores task->tk_client in sock_xprt::clnt as a raw pointer

and queues the worker; for TLS-secured transports that worker

is xs_tcp_tls_setup_socket(), which reads several fields out

of the saved pointer (cl_timeout, cl_program, cl_prog,

cl_vers, cl_cred, cl_stats) to construct the args for the

inner handshake rpc_clnt.

The xprt does not reference the rpc_clnt; the rpc_clnt

references the xprt. xs_destroy() does cancel the

connect_worker, but it runs only when the xprt's refcount

drops to zero, which cannot happen until the rpc_clnt

releases its cl_xprt reference in rpc_free_client_work().

When a TLS handshake fails fatally (for example, an mTLS

mount whose client cert does not match the server), the

connecting task is woken with -EACCES an

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References