{"id":"CVE-2026-72220","state":"PUBLISHED","title":"sunrpc: harden rq_procinfo lifecycle to prevent double-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: harden rq_procinfo lifecycle to prevent double-free\n\nThe svc_release_rqst() function executes the callback inside\nrqstp->rq_procinfo->pc_release. However, if a worker thread begins\nprocessing a new request and encounters an early error path (e.g.,\nunsupported protocol, short frame, or bad auth) before a valid\nrq_procinfo is installed, a stale release hook can be re-triggered\nagainst reused state from the previous RPC, resulting in a double-free\nor use-after-free vulnerability.\n\nHarden the lifecycle of rq_procinfo by:\n1. Ensuring svc_release_rqst() always clears rq_procinfo after the\n   optional pc_release() call, regardless of whether the hook exists.\n2. Explicitly clearing rq_procinfo at request entry in svc_process()\n   before any early decode or drop paths.\n3. Ensuring svc_process_bc() does the same at backchannel entry.\n\nThis guarantees that error flows will not encounter a non-NULL stale\nrq_procinfo pointer when there is nothing to release.","publishedAt":"2026-08-15T05:54:13.800Z","updatedAt":"2026-08-17T05:41:41.598Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d9adbb6e10bf7d4223d3d521ede1b2052903bc5e","status":"affected","lessThan":"66014ab165cb01bfef5836939412a8ef98d5d5ff","versionType":"git"},{"version":"d9adbb6e10bf7d4223d3d521ede1b2052903bc5e","status":"affected","lessThan":"31ba490c02d476a5e4f90b8845932ac9db8aa71b","versionType":"git"},{"version":"d9adbb6e10bf7d4223d3d521ede1b2052903bc5e","status":"affected","lessThan":"18d216788bef06332ff8901670ecf1ed8f6eb614","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/svc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.18","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/svc.c"]}],"references":["https://git.kernel.org/stable/c/66014ab165cb01bfef5836939412a8ef98d5d5ff","https://git.kernel.org/stable/c/31ba490c02d476a5e4f90b8845932ac9db8aa71b","https://git.kernel.org/stable/c/18d216788bef06332ff8901670ecf1ed8f6eb614"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72220.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72220","state":"PUBLISHED","datePublished":"2026-08-15T05:54:13.800Z","dateUpdated":"2026-08-17T05:41:41.598Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.913Z"},"containers":{"cna":{"title":"sunrpc: harden rq_procinfo lifecycle to prevent double-free","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: harden rq_procinfo lifecycle to prevent double-free\n\nThe svc_release_rqst() function executes the callback inside\nrqstp->rq_procinfo->pc_release. However, if a worker thread begins\nprocessing a new request and encounters an early error path (e.g.,\nunsupported protocol, short frame, or bad auth) before a valid\nrq_procinfo is installed, a stale release hook can be re-triggered\nagainst reused state from the previous RPC, resulting in a double-free\nor use-after-free vulnerability.\n\nHarden the lifecycle of rq_procinfo by:\n1. Ensuring svc_release_rqst() always clears rq_procinfo after the\n   optional pc_release() call, regardless of whether the hook exists.\n2. Explicitly clearing rq_procinfo at request entry in svc_process()\n   before any early decode or drop paths.\n3. Ensuring svc_process_bc() does the same at backchannel entry.\n\nThis guarantees that error flows will not encounter a non-NULL stale\nrq_procinfo pointer when there is nothing to release."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d9adbb6e10bf7d4223d3d521ede1b2052903bc5e","status":"affected","lessThan":"66014ab165cb01bfef5836939412a8ef98d5d5ff","versionType":"git"},{"version":"d9adbb6e10bf7d4223d3d521ede1b2052903bc5e","status":"affected","lessThan":"31ba490c02d476a5e4f90b8845932ac9db8aa71b","versionType":"git"},{"version":"d9adbb6e10bf7d4223d3d521ede1b2052903bc5e","status":"affected","lessThan":"18d216788bef06332ff8901670ecf1ed8f6eb614","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/svc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.18","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/svc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/66014ab165cb01bfef5836939412a8ef98d5d5ff"},{"url":"https://git.kernel.org/stable/c/31ba490c02d476a5e4f90b8845932ac9db8aa71b"},{"url":"https://git.kernel.org/stable/c/18d216788bef06332ff8901670ecf1ed8f6eb614"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in server-side SUNRPC request handling reached from remote RPC over TCP/UDP/RDMA transports used by nfsd and lockd (svc_recv→svc_handle_xprt→svc_process), exploitable by sending crafted ONC/RPC packets to listening NFS/NLM ports.\nAC:L - An attacker controls the RPC sequence and timing (valid request then malformed/short/bad-auth/bad-prog packet on the same pooled worker) to reliably re-trigger a stale pc_release without depending on uncontrollable layout or victim state.\nPR:N - Trigger paths include pre-authentication failures (garbage credentials, unknown program/version, short frames) that still call svc_release_rqst; stale rq_procinfo can be left by any prior RPC on the same worker, so no attacker credentials are required.\nUI:N - Exploitation requires only network RPC traffic to an already-running NFS/NLM server; no end-user actions such as mounting a share or opening files are needed beyond normal server exposure.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel context; it does not inherently cross a VM, container, or IOMMU security boundary to another authority.\nC:H - The bug is an explicit double-free/use-after-free of per-request NFS release state (e.g. nfsd4_release_compoundargs kfree/vfree chains and fh_put paths), enabling arbitrary kernel memory disclosure when exploited.\nI:H - Re-invoking pc_release on reused svc_rqst buffers corrupts heap metadata and object lifetimes, providing a standard kernel double-free/UAF primitive suitable for arbitrary write and code execution.\nA:H - Repeated or mistimed pc_release calls can immediately panic the kernel via SLUB double-free detection, oops, or wedged nfsd worker threads, causing complete loss of availability on NFS-serving systems."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:41:41.598Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}