CVE-2026-72466

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: Fix bcall rep leak and unbounded peek

rpcrdma_is_bcall() decodes a reply's first words to decide whether

the frame is a backchannel call. Two issues in that decode path

let a short or malformed reply leak the receive buffer and drain

the Receive queue.

First, the speculative peek

p = xdr_inline_decode(xdr, 0);

/* five p++ reads follow */

asks xdr_inline_decode() for zero bytes, which returns xdr->p

without consulting xdr->end. The five subsequent __be32 reads can

then walk up to 20 bytes past the wire payload into stale regbuf

contents and misclassify the reply as a backchannel call.

Second, after the post-peek

p = xdr_inline_decode(xdr, 3 * sizeof(*p));

if (unlikely(!p))

return true;

the short-header arm returns true without calling

rpcrdma_bc_receive_call(). The contract with the caller is that a

true return transfers ownership of rep to the backchannel path:

rpcrdma

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References