CVE-2026-72469

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: Fix ep kref imbalance on ADDR_CHANGE

rpcrdma_cm_event_handler() falls through to the disconnected: label

on RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no

matching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED.

The kref then underflows during connect teardown and

rpcrdma_xprt_disconnect() operates on a freed ep.

Reference counts across a normal connection lifecycle:

rpcrdma_ep_create() kref_init ->1

rpcrdma_xprt_connect() ep_get ->2 (before post_recvs)

RDMA_CM_EVENT_ESTABLISHED ep_get ->3

RDMA_CM_EVENT_DISCONNECTED ep_put ->2

rpcrdma_xprt_drain() ep_put ->1

rpcrdma_xprt_disconnect() tail ep_put ->0 (ep_destroy)

The connect-time get in rpcrdma_xprt_connect(), taken just before

rpcrdma_post_recvs() "while there are outstanding Receives," is

balanced by rpcrdma_xprt_drain.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References