CVE-2026-72166

A flaw was found in the Linux kernel's 9p client remote procedure call (RPC) implementation. When the p9_client_rpc() function is called with a P9_TFLUSH request and the transport has no peer, a fatal signal can cause an infinite loop. This prevents the affected process from terminating, leading to a permanent hang and a denial of service. This issue can be triggered, for example, during coredump operations.

Red Hat has evaluated this issue as having a Low impact because exploitation is restricted to local systems using the Plan 9 network protocol and requires a specific failure state where transport communication is severed without an active peer. In default Red Hat Enterprise Linux configurations, 9p client mounts are not actively utilized or enabled. While an unhandled fatal signal under these conditions can cause the calling thread to enter an uninterruptible sleep state during core dump or termination processing, this results strictly in a localized denial of service without compromising host confidentiality, integrity, or privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.