CVE-2026-72467
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
xprtrdma: Check frwr_wp_create() during connect
frwr_wp_create() creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave ep->re_write_pad_mr set to NULL.
rpcrdma_xprt_connect() currently ignores that return value. If frwr_wp_create() fails after the rest of the connection setup succeeds, xprt_rdma_connect_worker() treats the connection attempt as successful and sets XPRT_CONNECTED. A later NFS/RDMA read with a non-4-byte-aligned receive page length reaches rpcrdma_encode_write_list(), passes the NULL write-pad MR to encode_rdma_segment(), and dereferences it.
This is locally triggerable on an NFS/RDMA client after a connect or reconnect hits a local MR allocation, DMA-map, MR-map, or post-send failure; a remote peer alone cannot force the local MR setup failure.
Check the return value and fail the connect as -ENOTCONN, matching the adjacent setup failures. This keeps XPRT_CONNECTED clear and lets the normal reconnect path retry.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Linux kernel's rpcrdma subsystem, specifically within the xprtrdma transport layer that handles NFS over RDMA connections. This issue represents a critical flaw in error handling during the connection establishment phase where memory registration operations fail but are not properly propagated back to the connection state management logic. The problem manifests when the frwr_wp_create() function attempts to establish a singleton Memory Region for encoding padding in Write chunks with non-XDR-aligned payloads, which is essential for maintaining data integrity during RDMA operations.
The technical flaw occurs due to improper error propagation in the rpcrdma_xprt_connect() function which fails to check the return value from frwr_wp_create(). When this memory registration operation encounters failures related to local MR allocation, DMA mapping, MR mapping, or post-send operations, it returns a negative errno while leaving ep->re_write_pad_mr set to NULL. This inconsistent state allows the connection worker thread to incorrectly mark the transport as connected through XPRT_CONNECTED flag, even though critical resources remain unallocated. The vulnerability creates a dangerous race condition where the system believes a connection is established while certain memory regions necessary for data transfer operations are actually missing.
The operational impact of this vulnerability extends beyond simple connectivity issues to potentially cause system crashes and data corruption during NFS/RDMA read operations. When an NFS client attempts to read data with non-4-byte-aligned receive page lengths, the rpcrdma_encode_write_list() function invokes encode_rdma_segment() with a NULL write-pad Memory Region pointer, leading to immediate null pointer dereference. This scenario can result in kernel oops, system panics, or more subtle memory corruption that may persist silently until further operations trigger additional failures. The vulnerability is locally exploitable and requires only a connection attempt that encounters local resource allocation failures, making it particularly concerning for systems running NFS/RDMA services.
The root cause analysis reveals this as a classic error handling flaw that violates fundamental security principles of defensive programming. According to CWE-252, this represents an unchecked return value vulnerability where the failure path is not properly handled, leading to inconsistent system state. The ATT&CK framework categorizes this under privilege escalation through local system exploitation, as attackers can leverage this vulnerability to cause denial of service or potentially gain unauthorized access to system resources. The fix implemented involves proper error checking in the connection establishment code to ensure that any failure in frwr_wp_create() results in immediate connection failure with -ENOTCONN error code, preventing the XPRT_CONNECTED flag from being set and allowing normal retry mechanisms to function correctly.
This vulnerability highlights the critical importance of robust error handling in kernel space operations, particularly when dealing with memory management and hardware resource allocation. The fix ensures that all resource allocation failures during connection establishment are properly propagated up the call stack, maintaining system integrity and preventing inconsistent states that could be exploited by malicious actors. The solution aligns with industry best practices for kernel security where every resource allocation must be verified before considering a connection established, preventing the scenario where partial resource acquisition leads to system instability or potential exploitation. The implementation of proper error propagation maintains the expected behavior of the NFS/RDMA subsystem while preventing the dangerous condition where a connection appears valid but lacks essential memory region resources required for data transfer operations.