GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72220 (GCVE-0-2026-72220)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-08-17 05:41
VLAI
Title
sunrpc: harden rq_procinfo lifecycle to prevent double-free
Summary
In the Linux kernel, the following vulnerability has been resolved: sunrpc: harden rq_procinfo lifecycle to prevent double-free The svc_release_rqst() function executes the callback inside rqstp->rq_procinfo->pc_release. However, if a worker thread begins processing a new request and encounters an early error path (e.g., unsupported protocol, short frame, or bad auth) before a valid rq_procinfo is installed, a stale release hook can be re-triggered against reused state from the previous RPC, resulting in a double-free or use-after-free vulnerability. Harden the lifecycle of rq_procinfo by: 1. Ensuring svc_release_rqst() always clears rq_procinfo after the optional pc_release() call, regardless of whether the hook exists. 2. Explicitly clearing rq_procinfo at request entry in svc_process() before any early decode or drop paths. 3. Ensuring svc_process_bc() does the same at backchannel entry. This guarantees that error flows will not encounter a non-NULL stale rq_procinfo pointer when there is nothing to release.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d9adbb6e10bf7d4223d3d521ede1b2052903bc5e , < 66014ab165cb01bfef5836939412a8ef98d5d5ff (git)
Affected: d9adbb6e10bf7d4223d3d521ede1b2052903bc5e , < 31ba490c02d476a5e4f90b8845932ac9db8aa71b (git)
Affected: d9adbb6e10bf7d4223d3d521ede1b2052903bc5e , < 18d216788bef06332ff8901670ecf1ed8f6eb614 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66014ab165cb01bfef5836939412a8ef98d5d5ff",
              "status": "affected",
              "version": "d9adbb6e10bf7d4223d3d521ede1b2052903bc5e",
              "versionType": "git"
            },
            {
              "lessThan": "31ba490c02d476a5e4f90b8845932ac9db8aa71b",
              "status": "affected",
              "version": "d9adbb6e10bf7d4223d3d521ede1b2052903bc5e",
              "versionType": "git"
            },
            {
              "lessThan": "18d216788bef06332ff8901670ecf1ed8f6eb614",
              "status": "affected",
              "version": "d9adbb6e10bf7d4223d3d521ede1b2052903bc5e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: harden rq_procinfo lifecycle to prevent double-free\n\nThe svc_release_rqst() function executes the callback inside\nrqstp-\u003erq_procinfo-\u003epc_release. However, if a worker thread begins\nprocessing a new request and encounters an early error path (e.g.,\nunsupported protocol, short frame, or bad auth) before a valid\nrq_procinfo is installed, a stale release hook can be re-triggered\nagainst reused state from the previous RPC, resulting in a double-free\nor use-after-free vulnerability.\n\nHarden the lifecycle of rq_procinfo by:\n1. Ensuring svc_release_rqst() always clears rq_procinfo after the\n   optional pc_release() call, regardless of whether the hook exists.\n2. Explicitly clearing rq_procinfo at request entry in svc_process()\n   before any early decode or drop paths.\n3. Ensuring svc_process_bc() does the same at backchannel entry.\n\nThis guarantees that error flows will not encounter a non-NULL stale\nrq_procinfo pointer when there is nothing to release."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in server-side SUNRPC request handling reached from remote RPC over TCP/UDP/RDMA transports used by nfsd and lockd (svc_recv\u2192svc_handle_xprt\u2192svc_process), exploitable by sending crafted ONC/RPC packets to listening NFS/NLM ports.\nAC:L - An attacker controls the RPC sequence and timing (valid request then malformed/short/bad-auth/bad-prog packet on the same pooled worker) to reliably re-trigger a stale pc_release without depending on uncontrollable layout or victim state.\nPR:N - Trigger paths include pre-authentication failures (garbage credentials, unknown program/version, short frames) that still call svc_release_rqst; stale rq_procinfo can be left by any prior RPC on the same worker, so no attacker credentials are required.\nUI:N - Exploitation requires only network RPC traffic to an already-running NFS/NLM server; no end-user actions such as mounting a share or opening files are needed beyond normal server exposure.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel context; it does not inherently cross a VM, container, or IOMMU security boundary to another authority.\nC:H - The bug is an explicit double-free/use-after-free of per-request NFS release state (e.g. nfsd4_release_compoundargs kfree/vfree chains and fh_put paths), enabling arbitrary kernel memory disclosure when exploited.\nI:H - Re-invoking pc_release on reused svc_rqst buffers corrupts heap metadata and object lifetimes, providing a standard kernel double-free/UAF primitive suitable for arbitrary write and code execution.\nA:H - Repeated or mistimed pc_release calls can immediately panic the kernel via SLUB double-free detection, oops, or wedged nfsd worker threads, causing complete loss of availability on NFS-serving systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:41.598Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/66014ab165cb01bfef5836939412a8ef98d5d5ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/31ba490c02d476a5e4f90b8845932ac9db8aa71b"
        },
        {
          "url": "https://git.kernel.org/stable/c/18d216788bef06332ff8901670ecf1ed8f6eb614"
        }
      ],
      "title": "sunrpc: harden rq_procinfo lifecycle to prevent double-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72220",
    "datePublished": "2026-08-15T05:54:13.800Z",
    "dateReserved": "2026-08-09T03:40:39.913Z",
    "dateUpdated": "2026-08-17T05:41:41.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72220",
      "date": "2026-09-19",
      "epss": "0.00588",
      "percentile": "0.46819"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/svc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "66014ab165cb01bfef5836939412a8ef98d5d5ff",
                    "status": "affected",
                    "version": "d9adbb6e10bf7d4223d3d521ede1b2052903bc5e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "31ba490c02d476a5e4f90b8845932ac9db8aa71b",
                    "status": "affected",
                    "version": "d9adbb6e10bf7d4223d3d521ede1b2052903bc5e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "18d216788bef06332ff8901670ecf1ed8f6eb614",
                    "status": "affected",
                    "version": "d9adbb6e10bf7d4223d3d521ede1b2052903bc5e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/svc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.18"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: harden rq_procinfo lifecycle to prevent double-free\n\nThe svc_release_rqst() function executes the callback inside\nrqstp-\u003erq_procinfo-\u003epc_release. However, if a worker thread begins\nprocessing a new request and encounters an early error path (e.g.,\nunsupported protocol, short frame, or bad auth) before a valid\nrq_procinfo is installed, a stale release hook can be re-triggered\nagainst reused state from the previous RPC, resulting in a double-free\nor use-after-free vulnerability.\n\nHarden the lifecycle of rq_procinfo by:\n1. Ensuring svc_release_rqst() always clears rq_procinfo after the\n   optional pc_release() call, regardless of whether the hook exists.\n2. Explicitly clearing rq_procinfo at request entry in svc_process()\n   before any early decode or drop paths.\n3. Ensuring svc_process_bc() does the same at backchannel entry.\n\nThis guarantees that error flows will not encounter a non-NULL stale\nrq_procinfo pointer when there is nothing to release."
          }
        ],
        "id": "CVE-2026-72220",
        "lastModified": "2026-08-17T06:18:23.040",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:40.883",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/18d216788bef06332ff8901670ecf1ed8f6eb614"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/31ba490c02d476a5e4f90b8845932ac9db8aa71b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/66014ab165cb01bfef5836939412a8ef98d5d5ff"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-17T13:36:53+00:00",
      "cve": "CVE-2026-72220",
      "id": "CVE-2026-72220",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "184",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sunrpc: harden rq_procinfo lifecycle to prevent double-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72220.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:28:02Z",
      "cve": "CVE-2026-72220",
      "id": "CVE-2026-72220",
      "initial_release_date": "2026-08-21T00:42:22Z",
      "product_status:known_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72220",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72220.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.