CVE-2026-72221

A flaw was found in the kernel. A race condition exists in the sunrpc component during the Transport Layer Security (TLS) handshake cancellation process. This can lead to the corruption of an internal data structure, potentially causing system instability or a denial of service. Additionally, it may cause connections to be prematurely terminated, further contributing to a denial of service.

This vulnerability is rated as Important severity because race conditions during network connection teardown can corrupt kernel memory structures, leading to a kernel crash and system-wide denial of service. The issue specifically affects the kernel sunrpc layer when processing transport-layer security handshakes on server TCP endpoints. Exploitation requires the host to run network services that negotiate RPC-over-TLS, limiting exposure to systems actively serving TLS-encrypted RPC traffic. Environments that do not offer RPC services with TLS handshakes enabled remain unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.