CVE-2026-72467

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Linux kernel where the rpcrdma xprt connect() function ignores the return value of frwr wp create(). The frwr wp create() function is responsible for creating a singleton Memory Region used to encode padding for Write chunks with payload lengths that are not XDR-aligned. If frwr wp create() fails, it returns a negative errno and leaves the ep->re write pad mr variable set to NULL. Because the return value is ignored, xprt rdma connect worker() may incorrectly mark the connection as successful by setting XPRT CONNECTED. Subsequently, an NFS/RDMA read with a non-4-byte-aligned receive page length can trigger rpcrdma encode write list(), which passes the NULL write-pad MR to encode rdma segment(), leading to a null pointer dereference. This condition is locally triggerable on an NFS/RDMA client following a connect or reconnect failure related to local MR allocation, DMA-map, MR-map, or post-send failure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.