CVE-2026-72220

A flaw was found in the Linux kernel's sunrpc component. When a worker thread processes a new request and encounters an early error, a stale release hook can be re-triggered against previously used data. This can lead to a double-free or use-after-free vulnerability, potentially allowing an attacker to cause a denial of service or execute arbitrary code.

A stale rq_procinfo pointer in a reused SUNRPC server request object can cause svc_release_rqst() to invoke a previous pc_release callback against already released or reused RPC state, resulting in a double-free or use-after-free. A remote client may trigger the condition when a previous RPC installs a valid rq_procinfo and a subsequent request on the reused svc_rqst reaches an early error path, such as a short frame, unsupported protocol, or authentication failure, before a new procedure descriptor is installed.

For CVSS, AV:N/PR:N is used because an attacker can reach the vulnerable request-processing path remotely when an affected SUNRPC service is exposed, and the triggering error can occur before successful authentication. Practical exploitation has additional state-dependent complexity because it requires reuse of request state from a preceding RPC followed by an appropriate early-failing request. Exposure is primarily relevant to systems providing kernel SUNRPC services, such as NFS server deployments, which are commonly restricted to trusted storage or internal networks.

The directly supported impact is at least remote denial of service through kernel memory corruption and a possible crash. Because the underlying condition is a genuine double-free or use-after-free, confidentiality or integrity impact is possible in a paranoid worst-case assessment, although the patch does not demonstrate controlled memory corruption, information disclosure, privilege escalation, or remote code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce exposure to this vulnerability, disable the kernel NFS server if it is not required in your environment:

systemctl stop nfs-server.service

systemctl disable nfs-server.service