CVE-2026-72464

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the xprtrdma component where the system fails to repost receive buffers when handling malformed replies. Specifically, the rpcrdma wc receive() function decrements the transport's receive count, but certain exit paths for bad-version and short-reply responses in the rpcrdma reply handler() function do not call rpcrdma post recvs() to refill the queue. A remote peer can exploit this by sending a continuous stream of replies that are either shorter than the fixed transport header or contain an unrecognized RPC/RDMA version. This action drains the client's posted receive queue, causing the transport to stall until a reconnection occurs. Additionally, if the receive count is ratcheted down while the congestion window still admits rb credits RPCs, a burst of valid replies could trigger an RNR NAK, terminating the connection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.