CVE-2026-72464

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: Repost Receive buffers for malformed replies

rpcrdma_wc_receive() decrements the transport's Receive count for

every completion before it dispatches a successful Receive to

rpcrdma_reply_handler(). The handler must post a replacement

Receive WR before returning unless ownership of the rep has moved

elsewhere, as on the backchannel path.

Commit 2ae50ad68cd7 ("xprtrdma: Close window between waking RPC

senders and posting Receives") moved the Receive refill out of

rpcrdma_wc_receive(), where it had run ahead of every reply, into

rpcrdma_reply_handler() so that the responder's credit grant could

be parsed before reposting. The bad-version and short-reply exits

never reach that refill: they recycle the rep and return without

calling rpcrdma_post_recvs().

A remote peer can therefore drain the client's posted Receive

queue by sending a sustained stream of replies that are shorter

than the fixed transport header

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References