CVE-2026-72150 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: fix uninitialized xprt_create_args structure
The xprt_create_args structure is allocated on the stack without initialization in rpc_sysfs_xprt_switch_add_xprt_store(). While some fields are manually populated, critical fields like srcaddr, bc_xps, and flags contain uninitialized stack garbage.
This can lead to: 1. Kernel panic when xs_setup_xprt() dereferences garbage srcaddr 2. Information leak if srcaddr points to sensitive stack data 3. Unpredictable behavior if flags has random bits set
The fix is to zero-initialize the structure to ensure all unused fields are NULL/0, preventing the transport setup code from acting on garbage data.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability under discussion represents a critical uninitialized memory issue within the Linux kernel's rpc subsystem, specifically affecting the sunrpc module responsible for remote procedure calls. This flaw exists in the rpc_sysfs_xprt_switch_add_xprt_store() function where the xprt_create_args structure is allocated on the stack without proper initialization. The root cause stems from improper memory management practices that leave sensitive data fields uninitialized, creating potential attack vectors and system instability. According to CWE-457, this constitutes a use of uninitialized variable vulnerability that can lead to unpredictable behavior and security implications within kernel space operations.
The technical implementation flaw manifests through the allocation of xprt_create_args on the stack without zero-initialization, leaving critical fields containing residual stack data from previous operations. Fields such as srcaddr, bc_xps, and flags contain garbage values that are subsequently dereferenced or processed by downstream functions like xs_setup_xprt(). This uninitialized memory exposure creates multiple attack surfaces where malicious actors could potentially manipulate kernel behavior through carefully crafted inputs that exploit the unpredictable nature of these uninitialized fields. The vulnerability aligns with ATT&CK technique T1068 which involves exploiting local system vulnerabilities to gain elevated privileges.
The operational impact of this vulnerability extends beyond simple functional failures to encompass potential system instability and information disclosure risks. When xs_setup_xprt() attempts to dereference the garbage srcaddr pointer, it can cause immediate kernel panics due to invalid memory access patterns that crash the entire system. Additionally, if the srcaddr field points to sensitive stack data from previous function calls, this creates an information leak vulnerability where confidential kernel memory contents could be exposed to user-space processes through improper error handling or debugging interfaces. The unpredictable behavior resulting from random bits in the flags field can cause transport setup code to make incorrect decisions about connection parameters and protocol handling.
The mitigation strategy involves implementing proper zero-initialization of the xprt_create_args structure before populating individual fields, ensuring that all unused memory locations contain predictable values of NULL or zero. This approach prevents the transport setup code from acting on garbage data while maintaining the intended functionality of the existing field population logic. The fix directly addresses the root cause by eliminating uninitialized memory access patterns that could be exploited for privilege escalation or denial-of-service attacks. This remediation aligns with secure coding practices recommended in the CERT Secure Coding Standards and follows the principle of least privilege by ensuring kernel data structures contain only explicitly set values rather than residual stack contents that could be manipulated by attackers.