CVE-2026-72469

Status: UPDATED  |  Advisory ID: CVE-2026-72469

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: Fix ep kref imbalance on ADDR_CHANGE

rpcrdma_cm_event_handler() falls through to the disconnected: label

on RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no

matching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED.

The kref then underflows during connect teardown and

rpcrdma_xprt_disconnect() operates on a freed ep.

Reference counts across a normal connection lifecycle:

rpcrdma_ep_create() kref_init ->1

rpcrdma_xprt_connect() ep_get ->2 (before post_recvs)

RDMA_CM_EVENT_ESTABLISHED ep_get ->3

RDMA_CM_EVENT_DISCONNECTED ep_put ->2

rpcrdma_xprt_drain() ep_put ->1

rpcrdma_xprt_disconnect() tail ep_put ->0 (ep_destroy)

The connect-time get in rpcrdma_xprt_connect(), taken just before

rpcrdma_post_recvs() "while there are outstanding Receives," is

balanced by rpcrdma_xprt_drain. ADDR_CHANGE before ESTABLISHED has

no get to consume, so its put drops the count to 1 and the drain

put then frees the ep while rpcrdma_xprt_disconnect() still holds a

pointer to it.

Fix by dispatching on the prior re_connect_status via xchg(): for

prev == 0 (pre-ESTABLISHED) wake the connect waiter and return with

no put; for prev == 1 call rpcrdma_force_disconnect() and return.

The case-1 arm relies on the subsequent RDMA_CM_EVENT_DISCONNECTED

event -- reliably delivered when rdma_disconnect() is called on a

still-connected cm_id -- to balance the ESTABLISHED get;

rpcrdma_xprt_drain() continues to balance only that connect-time

get. Any other prior value means teardown is already in flight. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References