CVE-2026-72317

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the SUNRPC TLS connect path. The xs connect() function stores task->tk client in sock xprt::clnt as a raw pointer and queues a worker. For TLS-secured transports, the xs tcp tls setup socket() function reads several fields from this pointer, including cl timeout, cl program, cl prog, cl vers, cl cred, and cl stats, to construct arguments for the inner handshake. If a TLS handshake fails fatally, such as during an mTLS mount where the client certificate does not match the server, the upper rpc clnt may be freed before the queued connect worker executes. Consequently, xs tcp tls setup socket() dereferences the freed clnt pointer, leading to a refcount underflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.