CVE-2026-72217

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds store exists in the SUNRPC component. The function xdr buf to bvec() writes a bio vec into the caller's array before verifying if the slot is within the valid range. Specifically, the head branch performs the store without any check. When the caller's budget is fully exhausted, the subsequent store occurs one element beyond the array boundary. In the context of nfsd vfs write(), the rq bvec array is allocated with exactly rq maxpages entries and no extra space, allowing the out-of-bounds store to affect adjacent slab memory. The bv len and bv offset fields written during this process are derived from RPC payload sizes provided by the client.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.