{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-72317", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.919Z", "datePublished": "2026-08-15T05:55:31.022Z", "dateUpdated": "2026-08-17T05:42:43.024Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:42:43.024Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: pin upper rpc_clnt across the TLS connect_worker\n\nThe TLS connect path has a use-after-free: nothing pins the\nupper rpc_clnt across the delayed connect_worker. xs_connect()\nstores task->tk_client in sock_xprt::clnt as a raw pointer\nand queues the worker; for TLS-secured transports that worker\nis xs_tcp_tls_setup_socket(), which reads several fields out\nof the saved pointer (cl_timeout, cl_program, cl_prog,\ncl_vers, cl_cred, cl_stats) to construct the args for the\ninner handshake rpc_clnt.\n\nThe xprt does not reference the rpc_clnt; the rpc_clnt\nreferences the xprt. xs_destroy() does cancel the\nconnect_worker, but it runs only when the xprt's refcount\ndrops to zero, which cannot happen until the rpc_clnt\nreleases its cl_xprt reference in rpc_free_client_work().\nWhen a TLS handshake fails fatally (for example, an mTLS\nmount whose client cert does not match the server), the\nconnecting task is woken with -EACCES and exits, the mount\ncaller invokes rpc_shutdown_client(), and the upper rpc_clnt\nis freed before the queued connect_worker fires.\nxs_tcp_tls_setup_socket() then dereferences the freed clnt,\nproducing the refcount_t underflow Michael Nemanov reported.\n\nTake a reference on the upper rpc_clnt in xs_connect() for\nTLS transports via a new rpc_hold_client() helper, and drop\nit in the connect_worker's exit path with rpc_release_client().\nThe xprt_lock_connect() / xprt_unlock_connect() pairing\nalready serialises xs_connect() with xs_tcp_tls_setup_socket(),\nso the take and release are balanced one-for-one.\n\nThe non-TLS connect worker (xs_tcp_setup_socket) never reads\nsock_xprt::clnt, so leave that path alone and avoid the\nclnt-holds-xprt-holds-clnt cycle that would otherwise prevent\nxprt destruction." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The flaw is in the SUNRPC TCP-with-TLS client connect_worker processing a remote NFS server's TLS handshake; a malicious or misconfigured server can induce fatal handshake failure over the network before the delayed worker runs, matching network-reachable kTLS/RPC-with-TLS client paths.\nAC:L - An attacker operating a reachable NFS endpoint can reliably cause fatal TLS handshake failure (e.g., reject mTLS client certificates or send TLS alerts) and influence reconnect timing/backoff so client teardown frees rpc_clnt before the queued connect_worker executes.\nPR:N - Exploitation requires no privileges on the victim host; a remote peer only needs the client kernel to initiate or re-establish an NFS RPC-with-TLS connection, and TLS handshake processing occurs before NFS authentication completes.\nUI:N - No further victim action is needed once an NFS xprtsec=tls/mtls mount exists because automatic reconnect after server-induced disconnect or handshake failure can trigger the race without additional user interaction.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is standard local kernel compromise rather than crossing VM, container, or IOMMU security scopes.\nC:H - This is a kernel heap use-after-free where xs_tcp_tls_setup_socket reads multiple fields from a freed rpc_clnt (including cl_cred and cl_program), enabling information disclosure and further exploitation beyond a simple crash.\nI:H - Use-after-free of rpc_clnt permits corrupting allocator metadata and adjacent kernel objects; freed-object reuse can yield arbitrary write or control-flow hijack primitives, not merely authenticated data alteration.\nA:H - Accessing the freed rpc_clnt produces a refcount_t underflow and kernel oops/panic; even unsuccessful exploitation typically crashes or hangs the system, and repeated reconnect attempts can deny availability." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/sunrpc/clnt.h", "net/sunrpc/clnt.c", "net/sunrpc/xprtsock.c" ], "versions": [ { "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02", "lessThan": "79cd550f8c884523b604fbfa43eb02def74d6224", "status": "affected", "versionType": "git" }, { "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02", "lessThan": "7a65b41b657b71d5a77861f47dd13eb4bc8e10d0", "status": "affected", "versionType": "git" }, { "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02", "lessThan": "5b0427ba582d143a364301f825f4e32272f06d2d", "status": "affected", "versionType": "git" }, { "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02", "lessThan": "d49f6d098ed48775b9d27a9f9c5c220fdf76f102", "status": "affected", "versionType": "git" }, { "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02", "lessThan": "46bc86c833956219bbfd246c1ffd832a479c5199", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/sunrpc/clnt.h", "net/sunrpc/clnt.c", "net/sunrpc/xprtsock.c" ], "versions": [ { "version": "6.5", "status": "affected" }, { "version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.97" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.18.40" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.1.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/79cd550f8c884523b604fbfa43eb02def74d6224" }, { "url": "https://git.kernel.org/stable/c/7a65b41b657b71d5a77861f47dd13eb4bc8e10d0" }, { "url": "https://git.kernel.org/stable/c/5b0427ba582d143a364301f825f4e32272f06d2d" }, { "url": "https://git.kernel.org/stable/c/d49f6d098ed48775b9d27a9f9c5c220fdf76f102" }, { "url": "https://git.kernel.org/stable/c/46bc86c833956219bbfd246c1ffd832a479c5199" } ], "title": "SUNRPC: pin upper rpc_clnt across the TLS connect_worker", "x_generator": { "engine": "bippy-1.2.0" } } } }