CVE-2026-72217 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
xdr_buf_to_bvec() writes a bio_vec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the caller's budget is exactly used up, the next store lands one element past the end of the array. The overflow label returns count - 1, which masks the surplus store but cannot undo it.
rq_bvec, the array passed by nfsd_vfs_write(), is allocated to exactly rq_maxpages entries with no slack. The OOB store can land in adjacent slab memory; the bv_len and bv_offset fields written there are derived from client-supplied RPC payload sizes.
Move the in-range check ahead of the store in the head, page-loop, and tail branches. With the check at the top of each sequence, count is incremented only after a successful store, so the overflow label can return count directly.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's sunrpc subsystem represents a critical buffer overflow condition within the xdr_buf_to_bvec() function that can lead to memory corruption and potential privilege escalation. This flaw exists in the rpc implementation layer where network requests are processed, specifically affecting how bio_vec structures are stored into caller-provided arrays during data transfer operations. The issue stems from improper bounds checking that occurs before memory writes, creating a scenario where out-of-bounds memory access can occur even when the system appears to be operating within normal parameters.
The technical implementation flaw manifests in the xdr_buf_to_bvec() function where three distinct code paths execute identical operations without proper range validation. In all branches including head, page-loop, and tail sections, the function performs memory stores into bio_vec arrays before validating whether the target array slot is within acceptable bounds. The head branch particularly lacks any form of validation prior to execution, making it especially susceptible to this vulnerability. When the caller's allocated buffer space is exactly exhausted, the subsequent store operation writes beyond the intended array boundaries, potentially corrupting adjacent memory regions within the same slab allocation.
The operational impact of this vulnerability extends significantly within the nfsd_vfs_write() context where rq_bvec arrays are precisely allocated to match rq_maxpages entries without any padding. This exact sizing creates an environment where a single out-of-bounds write can overwrite adjacent memory locations, particularly affecting the bv_len and bv_offset fields that contain client-supplied RPC payload information. The vulnerability allows for potential data corruption, system instability, and could enable attackers to manipulate kernel memory structures through carefully crafted rpc requests, making it particularly dangerous in network-facing services.
This memory corruption vulnerability aligns with CWE-121 Stack-based Buffer Overflow and CWE-787 Out-of-bounds Write classifications, representing a classic case of improper input validation leading to memory safety issues. The flaw also maps to ATT&CK technique T1068 for local privilege escalation through kernel exploits and T1595 for reconnaissance activities targeting system vulnerabilities. The fix involves implementing proper bounds checking at the beginning of each processing branch before any memory store operations occur, ensuring that array indices are validated prior to accessing memory locations.
The mitigation strategy requires modifying the xdr_buf_to_bvec() function to perform range validation checks at the start of each code path rather than after potential stores. This change ensures that the count variable is only incremented following successful memory operations, preventing the overflow condition from occurring in the first place. The solution fundamentally addresses the root cause by enforcing proper bounds checking before any array modifications, thereby eliminating the possibility of out-of-bounds writes into adjacent kernel memory regions. This approach follows established secure coding practices and prevents the specific vulnerability pattern that enables memory corruption through improper input handling in kernel space operations.
The fix demonstrates proper defensive programming techniques that should be applied throughout kernel subsystems where external inputs are processed and stored into internal data structures. By implementing early validation checks, the system prevents potential exploitation scenarios while maintaining operational integrity of network services that rely on rpc mechanisms for data transfer operations. The solution ensures that even when client-supplied data approaches boundary conditions, the kernel maintains memory safety through proper input validation before any storage operations occur.