CVE-2026-72465

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the xprtrdma component where the rpcrdma reply handler() function branches away via out norqst before the credit clamp is applied. This allows a reply that does not match any pending request to reach out post with a raw credit value parsed directly from the wire. Because the rpcrdma post recvs() function does not bound its needed argument, a remote peer can send a well-formed reply with an unknown XID and an inflated credit grant. This triggers excessive allocation and chaining of Receive WRs (Work Requests) beyond the re max requests limit on every such reply.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.