CVE-2026-72467

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: Check frwr_wp_create() during connect

frwr_wp_create() creates the singleton Memory Region used to encode

padding for Write chunks whose payload length is not XDR-aligned. Its

failure paths return a negative errno and leave ep->re_write_pad_mr set

to NULL.

rpcrdma_xprt_connect() currently ignores that return value. If

frwr_wp_create() fails after the rest of the connection setup succeeds,

xprt_rdma_connect_worker() treats the connection attempt as successful

and sets XPRT_CONNECTED. A later NFS/RDMA read with a non-4-byte-aligned

receive page length reaches rpcrdma_encode_write_list(), passes the NULL

write-pad MR to encode_rdma_segment(), and dereferences it.

This is locally triggerable on an NFS/RDMA client after a connect or

reconnect hits a local MR allocation, DMA-map, MR-map, or post-send

failure; a remote peer alone cannot force the local MR setup failure.

Check the return value and fail the conne

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References