CVE-2026-72473

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: Decouple req recycling from RPC completion

rl_kref formerly served two distinct lifetimes through a single

refcount: it gated when a Reply could wake its RPC task, and it

gated when an rpcrdma_req could return to its free pool. The

marshal path took the Send-side reference only when SGEs needed

DMA-unmap (sc_unmap_count > 0), which made a Send carrying only

pre-registered buffers an exception: the Reply handler dropped

rl_kref from 1 to 0 and freed the req while the HCA might still

be DMA-reading from its send buffer.

Give rl_kref a narrower job. The RPC layer takes one reference

when slot allocation hands a req out. rpcrdma_prepare_send_sges()

takes a Send-side reference unconditionally after WR preparation

succeeds. xprt_rdma_free_slot() and xprt_rdma_bc_free_rqst() drop

the RPC-layer reference; rpcrdma_sendctx_unmap() drops the

Send-side reference. The req returns to its free pool only after

both owners

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References