{"id":"CVE-2026-72469","state":"PUBLISHED","title":"xprtrdma: Fix ep kref imbalance on ADDR_CHANGE","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Fix ep kref imbalance on ADDR_CHANGE\n\nrpcrdma_cm_event_handler() falls through to the disconnected: label\non RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no\nmatching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED.\nThe kref then underflows during connect teardown and\nrpcrdma_xprt_disconnect() operates on a freed ep.\n\nReference counts across a normal connection lifecycle:\n\n    rpcrdma_ep_create()             kref_init     ->1\n    rpcrdma_xprt_connect()          ep_get        ->2  (before post_recvs)\n    RDMA_CM_EVENT_ESTABLISHED       ep_get        ->3\n    RDMA_CM_EVENT_DISCONNECTED      ep_put        ->2\n    rpcrdma_xprt_drain()            ep_put        ->1\n    rpcrdma_xprt_disconnect() tail  ep_put        ->0  (ep_destroy)\n\nThe connect-time get in rpcrdma_xprt_connect(), taken just before\nrpcrdma_post_recvs() \"while there are outstanding Receives,\" is\nbalanced by rpcrdma_xprt_drain. ADDR_CHANGE before ESTABLISHED has\nno get to consume, so its put drops the count to 1 and the drain\nput then frees the ep while rpcrdma_xprt_disconnect() still holds a\npointer to it.\n\nFix by dispatching on the prior re_connect_status via xchg(): for\nprev == 0 (pre-ESTABLISHED) wake the connect waiter and return with\nno put; for prev == 1 call rpcrdma_force_disconnect() and return.\nThe case-1 arm relies on the subsequent RDMA_CM_EVENT_DISCONNECTED\nevent -- reliably delivered when rdma_disconnect() is called on a\nstill-connected cm_id -- to balance the ESTABLISHED get;\nrpcrdma_xprt_drain() continues to balance only that connect-time\nget. Any other prior value means teardown is already in flight.","publishedAt":"2026-08-15T05:57:11.829Z","updatedAt":"2026-10-21T12:44:59.460Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2acc5cae292355f5f18ad377a2a966e7f03c8fec","status":"affected","lessThan":"a562485c359d0b20a99d466b042af9c2f7ff3326","versionType":"git"},{"version":"2acc5cae292355f5f18ad377a2a966e7f03c8fec","status":"affected","lessThan":"cfd1bab66b042da7a778786685125656c695931b","versionType":"git"},{"version":"2acc5cae292355f5f18ad377a2a966e7f03c8fec","status":"affected","lessThan":"d0479c2b12974aa188b10d221a5770126b118b6d","versionType":"git"},{"version":"2acc5cae292355f5f18ad377a2a966e7f03c8fec","status":"affected","lessThan":"ffc07790539736a5d029f6a3c966b46c529f93a8","versionType":"git"},{"version":"2acc5cae292355f5f18ad377a2a966e7f03c8fec","status":"affected","lessThan":"af9b65b29af341932625c4283dc7a23cdb62688a","versionType":"git"},{"version":"2fcbf07a4f23174a45e015b62a8e42ddbc2e53ef","status":"affected","versionType":"git"},{"version":"5.7.9","status":"affected","lessThan":"5.8","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/xprtrdma/verbs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/xprtrdma/verbs.c"]}],"references":["https://git.kernel.org/stable/c/a562485c359d0b20a99d466b042af9c2f7ff3326","https://git.kernel.org/stable/c/cfd1bab66b042da7a778786685125656c695931b","https://git.kernel.org/stable/c/d0479c2b12974aa188b10d221a5770126b118b6d","https://git.kernel.org/stable/c/ffc07790539736a5d029f6a3c966b46c529f93a8","https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72469.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72469","state":"PUBLISHED","datePublished":"2026-08-15T05:57:11.829Z","dateUpdated":"2026-10-21T12:44:59.460Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.934Z"},"containers":{"cna":{"title":"xprtrdma: Fix ep kref imbalance on ADDR_CHANGE","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Fix ep kref imbalance on ADDR_CHANGE\n\nrpcrdma_cm_event_handler() falls through to the disconnected: label\non RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no\nmatching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED.\nThe kref then underflows during connect teardown and\nrpcrdma_xprt_disconnect() operates on a freed ep.\n\nReference counts across a normal connection lifecycle:\n\n    rpcrdma_ep_create()             kref_init     ->1\n    rpcrdma_xprt_connect()          ep_get        ->2  (before post_recvs)\n    RDMA_CM_EVENT_ESTABLISHED       ep_get        ->3\n    RDMA_CM_EVENT_DISCONNECTED      ep_put        ->2\n    rpcrdma_xprt_drain()            ep_put        ->1\n    rpcrdma_xprt_disconnect() tail  ep_put        ->0  (ep_destroy)\n\nThe connect-time get in rpcrdma_xprt_connect(), taken just before\nrpcrdma_post_recvs() \"while there are outstanding Receives,\" is\nbalanced by rpcrdma_xprt_drain. ADDR_CHANGE before ESTABLISHED has\nno get to consume, so its put drops the count to 1 and the drain\nput then frees the ep while rpcrdma_xprt_disconnect() still holds a\npointer to it.\n\nFix by dispatching on the prior re_connect_status via xchg(): for\nprev == 0 (pre-ESTABLISHED) wake the connect waiter and return with\nno put; for prev == 1 call rpcrdma_force_disconnect() and return.\nThe case-1 arm relies on the subsequent RDMA_CM_EVENT_DISCONNECTED\nevent -- reliably delivered when rdma_disconnect() is called on a\nstill-connected cm_id -- to balance the ESTABLISHED get;\nrpcrdma_xprt_drain() continues to balance only that connect-time\nget. Any other prior value means teardown is already in flight."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2acc5cae292355f5f18ad377a2a966e7f03c8fec","status":"affected","lessThan":"a562485c359d0b20a99d466b042af9c2f7ff3326","versionType":"git"},{"version":"2acc5cae292355f5f18ad377a2a966e7f03c8fec","status":"affected","lessThan":"cfd1bab66b042da7a778786685125656c695931b","versionType":"git"},{"version":"2acc5cae292355f5f18ad377a2a966e7f03c8fec","status":"affected","lessThan":"d0479c2b12974aa188b10d221a5770126b118b6d","versionType":"git"},{"version":"2acc5cae292355f5f18ad377a2a966e7f03c8fec","status":"affected","lessThan":"ffc07790539736a5d029f6a3c966b46c529f93a8","versionType":"git"},{"version":"2acc5cae292355f5f18ad377a2a966e7f03c8fec","status":"affected","lessThan":"af9b65b29af341932625c4283dc7a23cdb62688a","versionType":"git"},{"version":"2fcbf07a4f23174a45e015b62a8e42ddbc2e53ef","status":"affected","versionType":"git"},{"version":"5.7.9","status":"affected","lessThan":"5.8","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/xprtrdma/verbs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/xprtrdma/verbs.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a562485c359d0b20a99d466b042af9c2f7ff3326"},{"url":"https://git.kernel.org/stable/c/cfd1bab66b042da7a778786685125656c695931b"},{"url":"https://git.kernel.org/stable/c/d0479c2b12974aa188b10d221a5770126b118b6d"},{"url":"https://git.kernel.org/stable/c/ffc07790539736a5d029f6a3c966b46c529f93a8"},{"url":"https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the NFS/RPC-over-RDMA client reached during RDMA CM connect/reconnect to a remote server; ADDR_CHANGE is delivered on bonded RoCE/IB netdev failover on the storage network segment, a plausible adjacent-network trigger in HPC and cloud NFS-over-RDMA deployments.\nAC:L - Once NFS-over-RDMA is in use, an attacker can reliably drive repeated reconnect attempts and time or induce bonding failover so ADDR_CHANGE arrives pre-ESTABLISHED; the resulting kref underflow and UAF are deterministic, not a probabilistic memory-layout race.\nPR:N - Exploitation requires no privileges on the victim host—only that NFS-over-RDMA is configured and reconnects occur—while an adjacent attacker or malicious storage peer can provoke link failover and connection churn without authenticating to the victim system.\nUI:N - No victim user interaction is required beyond normal automated NFS-over-RDMA client reconnect activity already performed by the kernel when links fail or sessions drop.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - Premature free of rpcrdma_ep leaves dangling pointers used in rpcrdma_xprt_disconnect (rdma_disconnect, ib_drain_rq/sq), a classic kernel heap UAF that can be leveraged for arbitrary memory disclosure via controlled reuse of the freed endpoint object.\nI:H - Teardown continues to operate on the freed endpoint and associated RDMA/IB state, enabling heap corruption and potential arbitrary kernel write or control-flow hijack, not merely a benign NULL dereference crash.\nA:H - The kref imbalance causes premature endpoint destruction during disconnect teardown, which can trigger kernel oops/panic from use-after-free even when exploitation for code execution is not attempted."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-21T12:44:59.460Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7.9"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-72469","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:50:27.416569Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T18:55:25.440Z"}}]}}}