CVE-2026-72473

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the xprtrdma module where a single reference count rl kref was used to manage two distinct lifetimes: the wake-up of an RPC task upon reply and the return of an rpcrdma req to its free pool. In cases where a Send operation used only pre-registered buffers, the reply handler could drop the reference count to zero and free the request while the Host Channel Adapter (HCA) was still performing a DMA-read from the send buffer. This is addressed by decoupling request recycling from RPC completion, ensuring the request returns to the free pool only after both the RPC layer and the Send-side references are released. The fix involves moving initialization to slot-allocation paths and updating the rpcrdma reply handler() function to call rpcrdma complete rqst() instead of kref put() on the non-LocalInv branch.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.