CVE-2026-72217

A flaw was found in the Linux kernel's SUNRPC component. The xdr_buf_to_bvec() function performs an out-of-bounds write when processing client-supplied RPC (Remote Procedure Call) payload sizes without proper boundary checks. A remote attacker could exploit this by crafting malicious RPC requests, leading to memory corruption. This could result in a denial of service or other system instability.

This vulnerability is rated as Important because remote clients can trigger kernel slab memory corruption and crash the host by transmitting crafted Remote Procedure Call write requests to an exposed NFS server. The flaw specifically impacts deployments providing NFS services on modern kernel releases, whereas earlier versions such as Red Hat Enterprise Linux 8 and 9 do not contain the vulnerable code. Systems that do not export NFS shares or that strictly isolate NFS traffic to trusted private networks significantly reduce the risk of remote exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.