CVE-2026-72465

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: Sanitize the reply credit grant after parsing

The out_norqst exit in rpcrdma_reply_handler() branches away before

the credit clamp, so a reply that matches no pending request reaches

out_post carrying the raw credit value parsed from the wire.

rpcrdma_post_recvs() does not bound its @needed argument: the refill

loop allocates and chains Receive WRs until the count is satisfied or

allocation fails. A peer that sends a well-formed reply carrying an

unknown XID and an inflated credit grant therefore drives rep

allocation and Receive posting past re_max_requests on every such

reply.

Move the clamp to immediately after the credit field is parsed,

ahead of the first branch that can reach out_post, so every later

consumer sees a sanitized value. The cwnd update stays on the

matched-request path.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References