CVE-2026-72150

A flaw was found in the Linux kernel's sunrpc component. The xprt_create_args structure is allocated on the stack without initialization in rpc_sysfs_xprt_switch_add_xprt_store(). This can lead to critical fields containing uninitialized stack garbage. Exploiting this vulnerability can result in a kernel panic, causing a denial of service, or an information leak, potentially exposing sensitive stack data.

An uninitialized xprt_create_args structure in rpc_sysfs_xprt_switch_add_xprt_store can leave fields such as srcaddr, bc_xps, and flags filled with stack garbage. The transport setup path may then dereference a garbage srcaddr, use unexpected flags, or expose unintended stack derived data, resulting in kernel panic or a limited information leak. For the CVSS the PR:L is used in the paranoid score because a local user or service with delegated write access to the SUNRPC sysfs control path could reach the store handler, while typical systems restrict this path to root or an administrator. The issue is not directly network reachable and requires local interaction with the SUNRPC sysfs control plane. Impact is at least local denial of service via kernel crash and in worst case may allow limited confidentiality or integrity impact due to use of uninitialized stack data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.