GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72317 (GCVE-0-2026-72317)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
SUNRPC: pin upper rpc_clnt across the TLS connect_worker
Summary
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc_clnt across the TLS connect_worker The TLS connect path has a use-after-free: nothing pins the upper rpc_clnt across the delayed connect_worker. xs_connect() stores task->tk_client in sock_xprt::clnt as a raw pointer and queues the worker; for TLS-secured transports that worker is xs_tcp_tls_setup_socket(), which reads several fields out of the saved pointer (cl_timeout, cl_program, cl_prog, cl_vers, cl_cred, cl_stats) to construct the args for the inner handshake rpc_clnt. The xprt does not reference the rpc_clnt; the rpc_clnt references the xprt. xs_destroy() does cancel the connect_worker, but it runs only when the xprt's refcount drops to zero, which cannot happen until the rpc_clnt releases its cl_xprt reference in rpc_free_client_work(). When a TLS handshake fails fatally (for example, an mTLS mount whose client cert does not match the server), the connecting task is woken with -EACCES and exits, the mount caller invokes rpc_shutdown_client(), and the upper rpc_clnt is freed before the queued connect_worker fires. xs_tcp_tls_setup_socket() then dereferences the freed clnt, producing the refcount_t underflow Michael Nemanov reported. Take a reference on the upper rpc_clnt in xs_connect() for TLS transports via a new rpc_hold_client() helper, and drop it in the connect_worker's exit path with rpc_release_client(). The xprt_lock_connect() / xprt_unlock_connect() pairing already serialises xs_connect() with xs_tcp_tls_setup_socket(), so the take and release are balanced one-for-one. The non-TLS connect worker (xs_tcp_setup_socket) never reads sock_xprt::clnt, so leave that path alone and avoid the clnt-holds-xprt-holds-clnt cycle that would otherwise prevent xprt destruction.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 75eb6af7acdf566c68d61e98e67ee2f235201c02 , < 79cd550f8c884523b604fbfa43eb02def74d6224 (git)
Affected: 75eb6af7acdf566c68d61e98e67ee2f235201c02 , < 7a65b41b657b71d5a77861f47dd13eb4bc8e10d0 (git)
Affected: 75eb6af7acdf566c68d61e98e67ee2f235201c02 , < 5b0427ba582d143a364301f825f4e32272f06d2d (git)
Affected: 75eb6af7acdf566c68d61e98e67ee2f235201c02 , < d49f6d098ed48775b9d27a9f9c5c220fdf76f102 (git)
Affected: 75eb6af7acdf566c68d61e98e67ee2f235201c02 , < 46bc86c833956219bbfd246c1ffd832a479c5199 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sunrpc/clnt.h",
            "net/sunrpc/clnt.c",
            "net/sunrpc/xprtsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "79cd550f8c884523b604fbfa43eb02def74d6224",
              "status": "affected",
              "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02",
              "versionType": "git"
            },
            {
              "lessThan": "7a65b41b657b71d5a77861f47dd13eb4bc8e10d0",
              "status": "affected",
              "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02",
              "versionType": "git"
            },
            {
              "lessThan": "5b0427ba582d143a364301f825f4e32272f06d2d",
              "status": "affected",
              "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02",
              "versionType": "git"
            },
            {
              "lessThan": "d49f6d098ed48775b9d27a9f9c5c220fdf76f102",
              "status": "affected",
              "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02",
              "versionType": "git"
            },
            {
              "lessThan": "46bc86c833956219bbfd246c1ffd832a479c5199",
              "status": "affected",
              "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sunrpc/clnt.h",
            "net/sunrpc/clnt.c",
            "net/sunrpc/xprtsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: pin upper rpc_clnt across the TLS connect_worker\n\nThe TLS connect path has a use-after-free: nothing pins the\nupper rpc_clnt across the delayed connect_worker. xs_connect()\nstores task-\u003etk_client in sock_xprt::clnt as a raw pointer\nand queues the worker; for TLS-secured transports that worker\nis xs_tcp_tls_setup_socket(), which reads several fields out\nof the saved pointer (cl_timeout, cl_program, cl_prog,\ncl_vers, cl_cred, cl_stats) to construct the args for the\ninner handshake rpc_clnt.\n\nThe xprt does not reference the rpc_clnt; the rpc_clnt\nreferences the xprt. xs_destroy() does cancel the\nconnect_worker, but it runs only when the xprt\u0027s refcount\ndrops to zero, which cannot happen until the rpc_clnt\nreleases its cl_xprt reference in rpc_free_client_work().\nWhen a TLS handshake fails fatally (for example, an mTLS\nmount whose client cert does not match the server), the\nconnecting task is woken with -EACCES and exits, the mount\ncaller invokes rpc_shutdown_client(), and the upper rpc_clnt\nis freed before the queued connect_worker fires.\nxs_tcp_tls_setup_socket() then dereferences the freed clnt,\nproducing the refcount_t underflow Michael Nemanov reported.\n\nTake a reference on the upper rpc_clnt in xs_connect() for\nTLS transports via a new rpc_hold_client() helper, and drop\nit in the connect_worker\u0027s exit path with rpc_release_client().\nThe xprt_lock_connect() / xprt_unlock_connect() pairing\nalready serialises xs_connect() with xs_tcp_tls_setup_socket(),\nso the take and release are balanced one-for-one.\n\nThe non-TLS connect worker (xs_tcp_setup_socket) never reads\nsock_xprt::clnt, so leave that path alone and avoid the\nclnt-holds-xprt-holds-clnt cycle that would otherwise prevent\nxprt destruction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in the SUNRPC TCP-with-TLS client connect_worker processing a remote NFS server\u0027s TLS handshake; a malicious or misconfigured server can induce fatal handshake failure over the network before the delayed worker runs, matching network-reachable kTLS/RPC-with-TLS client paths.\nAC:L - An attacker operating a reachable NFS endpoint can reliably cause fatal TLS handshake failure (e.g., reject mTLS client certificates or send TLS alerts) and influence reconnect timing/backoff so client teardown frees rpc_clnt before the queued connect_worker executes.\nPR:N - Exploitation requires no privileges on the victim host; a remote peer only needs the client kernel to initiate or re-establish an NFS RPC-with-TLS connection, and TLS handshake processing occurs before NFS authentication completes.\nUI:N - No further victim action is needed once an NFS xprtsec=tls/mtls mount exists because automatic reconnect after server-induced disconnect or handshake failure can trigger the race without additional user interaction.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is standard local kernel compromise rather than crossing VM, container, or IOMMU security scopes.\nC:H - This is a kernel heap use-after-free where xs_tcp_tls_setup_socket reads multiple fields from a freed rpc_clnt (including cl_cred and cl_program), enabling information disclosure and further exploitation beyond a simple crash.\nI:H - Use-after-free of rpc_clnt permits corrupting allocator metadata and adjacent kernel objects; freed-object reuse can yield arbitrary write or control-flow hijack primitives, not merely authenticated data alteration.\nA:H - Accessing the freed rpc_clnt produces a refcount_t underflow and kernel oops/panic; even unsuccessful exploitation typically crashes or hangs the system, and repeated reconnect attempts can deny availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:43.024Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/79cd550f8c884523b604fbfa43eb02def74d6224"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a65b41b657b71d5a77861f47dd13eb4bc8e10d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b0427ba582d143a364301f825f4e32272f06d2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d49f6d098ed48775b9d27a9f9c5c220fdf76f102"
        },
        {
          "url": "https://git.kernel.org/stable/c/46bc86c833956219bbfd246c1ffd832a479c5199"
        }
      ],
      "title": "SUNRPC: pin upper rpc_clnt across the TLS connect_worker",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72317",
    "datePublished": "2026-08-15T05:55:31.022Z",
    "dateReserved": "2026-08-09T03:40:39.919Z",
    "dateUpdated": "2026-08-17T05:42:43.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72317",
      "date": "2026-09-17",
      "epss": "0.00644",
      "percentile": "0.49278"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72317\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:04.620\",\"lastModified\":\"2026-08-17T06:18:35.000\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: pin upper rpc_clnt across the TLS connect_worker\\n\\nThe TLS connect path has a use-after-free: nothing pins the\\nupper rpc_clnt across the delayed connect_worker. xs_connect()\\nstores task-\u003etk_client in sock_xprt::clnt as a raw pointer\\nand queues the worker; for TLS-secured transports that worker\\nis xs_tcp_tls_setup_socket(), which reads several fields out\\nof the saved pointer (cl_timeout, cl_program, cl_prog,\\ncl_vers, cl_cred, cl_stats) to construct the args for the\\ninner handshake rpc_clnt.\\n\\nThe xprt does not reference the rpc_clnt; the rpc_clnt\\nreferences the xprt. xs_destroy() does cancel the\\nconnect_worker, but it runs only when the xprt\u0027s refcount\\ndrops to zero, which cannot happen until the rpc_clnt\\nreleases its cl_xprt reference in rpc_free_client_work().\\nWhen a TLS handshake fails fatally (for example, an mTLS\\nmount whose client cert does not match the server), the\\nconnecting task is woken with -EACCES and exits, the mount\\ncaller invokes rpc_shutdown_client(), and the upper rpc_clnt\\nis freed before the queued connect_worker fires.\\nxs_tcp_tls_setup_socket() then dereferences the freed clnt,\\nproducing the refcount_t underflow Michael Nemanov reported.\\n\\nTake a reference on the upper rpc_clnt in xs_connect() for\\nTLS transports via a new rpc_hold_client() helper, and drop\\nit in the connect_worker\u0027s exit path with rpc_release_client().\\nThe xprt_lock_connect() / xprt_unlock_connect() pairing\\nalready serialises xs_connect() with xs_tcp_tls_setup_socket(),\\nso the take and release are balanced one-for-one.\\n\\nThe non-TLS connect worker (xs_tcp_setup_socket) never reads\\nsock_xprt::clnt, so leave that path alone and avoid the\\nclnt-holds-xprt-holds-clnt cycle that would otherwise prevent\\nxprt destruction.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/sunrpc/clnt.h\",\"net/sunrpc/clnt.c\",\"net/sunrpc/xprtsock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"75eb6af7acdf566c68d61e98e67ee2f235201c02\",\"lessThan\":\"79cd550f8c884523b604fbfa43eb02def74d6224\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"75eb6af7acdf566c68d61e98e67ee2f235201c02\",\"lessThan\":\"7a65b41b657b71d5a77861f47dd13eb4bc8e10d0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"75eb6af7acdf566c68d61e98e67ee2f235201c02\",\"lessThan\":\"5b0427ba582d143a364301f825f4e32272f06d2d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"75eb6af7acdf566c68d61e98e67ee2f235201c02\",\"lessThan\":\"d49f6d098ed48775b9d27a9f9c5c220fdf76f102\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"75eb6af7acdf566c68d61e98e67ee2f235201c02\",\"lessThan\":\"46bc86c833956219bbfd246c1ffd832a479c5199\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/sunrpc/clnt.h\",\"net/sunrpc/clnt.c\",\"net/sunrpc/xprtsock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/46bc86c833956219bbfd246c1ffd832a479c5199\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5b0427ba582d143a364301f825f4e32272f06d2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/79cd550f8c884523b604fbfa43eb02def74d6224\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7a65b41b657b71d5a77861f47dd13eb4bc8e10d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d49f6d098ed48775b9d27a9f9c5c220fdf76f102\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T21:43:41+00:00",
      "cve": "CVE-2026-72317",
      "id": "CVE-2026-72317",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72317.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T15:40:35Z",
      "cve": "CVE-2026-72317",
      "id": "CVE-2026-72317",
      "initial_release_date": "2026-08-22T00:54:08Z",
      "product_status:first_fixed": "96",
      "product_status:known_affected": "723",
      "product_status:recommended": "42",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72317",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72317.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.