CVE-2026-72491

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the 9p network filesystem implementation within trans rdma.c. The rdma->state variable is modified without holding the req lock spinlock in the recv done() and p9 cm event handler() functions, while the rdma request() function accesses the same variable under the lock. This inconsistent locking can lead to lost state transitions, where a transition to a flushing or closed state is overwritten. Consequently, this corrupts the connection state machine and may result in a use-after-free condition on RDMA request objects during the teardown process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.