CVE-2026-72466

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description Two issues in the rpcrdma is bcall() function allow a short or malformed reply to leak the receive buffer and drain the Receive queue. First, a speculative peek using xdr inline decode() for zero bytes returns a pointer without checking xdr->end, allowing subsequent reads to access up to 20 bytes of stale regbuf contents and misclassify the reply as a backchannel call. Second, the short-header path returns true without calling rpcrdma bc receive call(), causing the rpcrdma reply handler() function to return without executing rpcrdma rep put() and rpcrdma post recvs(). This results in the receive buffer being orphaned and not freed until transport teardown, which can lead to the Receive queue draining and the peer receiving RNR NAKs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.