CVE-2026-72220 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: harden rq_procinfo lifecycle to prevent double-free
The svc_release_rqst() function executes the callback inside rqstp->rq_procinfo->pc_release. However, if a worker thread begins processing a new request and encounters an early error path (e.g., unsupported protocol, short frame, or bad auth) before a valid rq_procinfo is installed, a stale release hook can be re-triggered against reused state from the previous RPC, resulting in a double-free or use-after-free vulnerability.
Harden the lifecycle of rq_procinfo by: 1. Ensuring svc_release_rqst() always clears rq_procinfo after the optional pc_release() call, regardless of whether the hook exists. 2. Explicitly clearing rq_procinfo at request entry in svc_process() before any early decode or drop paths. 3. Ensuring svc_process_bc() does the same at backchannel entry.
This guarantees that error flows will not encounter a non-NULL stale rq_procinfo pointer when there is nothing to release.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's sunrpc subsystem represents a critical memory safety issue that arises from improper management of request processing state during RPC (Remote Procedure Call) operations. This flaw manifests as a potential double-free or use-after-free condition that can compromise system stability and potentially enable privilege escalation attacks. The vulnerability specifically affects how the kernel handles the lifecycle of rq_procinfo structures within the svc_release_rqst() function, creating opportunities for malicious actors to exploit memory corruption patterns through carefully crafted RPC requests.
The technical root cause stems from the improper handling of request processing state transitions in the RPC service framework. When worker threads process incoming RPC requests, they may encounter early termination conditions such as unsupported protocols, malformed frames, or authentication failures before establishing a valid rq_procinfo structure. During these error paths, the svc_release_rqst() function attempts to execute the pc_release callback from the existing rq_procinfo pointer, but this pointer may reference stale memory that has already been freed or reused for different requests. This creates a scenario where the same release hook can be executed against memory that no longer corresponds to the current request context, leading to undefined behavior and potential system crashes.
The operational impact of this vulnerability extends beyond simple service disruption to potentially enable more severe security consequences within kernel space operations. Attackers could leverage this double-free condition to corrupt kernel memory structures, potentially allowing for privilege escalation or denial-of-service attacks against systems running affected Linux kernels. The vulnerability affects the core RPC processing pipeline and can be triggered through various network-based attack vectors that send malformed RPC requests to services utilizing the sunrpc subsystem. Given that RPC services are fundamental to many networked applications including NFS, NIS, and other distributed computing frameworks, this flaw represents a significant risk to enterprise and server environments.
The fix implemented addresses the vulnerability by establishing proper lifecycle management for rq_procinfo structures through three key mechanisms that align with established security best practices. First, the solution ensures that svc_release_rqst() always clears the rq_procinfo pointer after executing any optional pc_release callback, regardless of whether the callback exists or not, preventing reuse of stale pointers. Second, the implementation explicitly clears rq_procinfo at request entry in svc_process() before any early decode or drop paths are processed, eliminating race conditions during error handling scenarios. Third, the fix extends this protection to svc_process_bc() for backchannel operations, ensuring comprehensive coverage across all RPC processing pathways. This approach directly addresses the underlying CWE-415 Double Free and CWE-416 Use After Free vulnerabilities by enforcing proper memory state management throughout the request lifecycle.
The mitigation strategy follows established principles from ATT&CK framework category T1068, specifically targeting privilege escalation techniques through kernel memory corruption. By ensuring that all error paths properly clean up request state before reusing memory structures, the fix prevents attackers from exploiting the timing window between request processing and memory deallocation. The solution maintains backward compatibility while strengthening the kernel's memory safety mechanisms, aligning with security standards such as those outlined in the Linux Kernel Security documentation and the CERT/CC secure coding guidelines. This defensive programming approach reduces the attack surface of RPC services and prevents the exploitation of memory corruption vulnerabilities that could otherwise be leveraged for system compromise or data exfiltration attacks.