CVE-2026-72222

A flaw was found in the Linux kernel's sunrpc component, which affects TLS-enabled Network File System (NFS) servers. A race condition exists during the asynchronous TLS handshake process. A remote attacker could exploit this by closing a connection at a specific time, leading to memory corruption. This could result in system instability or other unpredictable behavior.

Red Hat has rated this vulnerability as having an Important impact because a remote user can induce kernel slab memory corruption by terminating connections during transport layer security negotiations, potentially compromising host stability or integrity. This flaw specifically targets systems operating as Network File System servers with RPC-over-TLS configured and active. Standard installations where the kernel RPC transport does not utilize TLS or where the host does not serve file shares over NFS are unaffected by this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable the TLS handshake daemon if RPC-over-TLS is not required, or restrict NFS network access to trusted clients:

1. Stop and mask the TLS handshake service to prevent kernel TLS sessions:

systemctl stop tlshd.service

systemctl mask tlshd.service

2. Alternatively, restrict access to the NFS daemon (TCP port 2049) to trusted networks using firewalld:

firewall-cmd --permanent --zone=public --remove-service=nfs

firewall-cmd --permanent --zone=trusted --add-source=<trusted_subnet>

firewall-cmd --reload

Caveats: Disabling tlshd prevents clients from establishing RPC connections secured by TLS, which may cause connection attempts requiring TLS transport security to fail. Restricting network access via firewalld blocks connections from non-allowlisted hosts.

Warning: Reloading firewall configurations with 'firewall-cmd --reload' or stopping system services may momentarily disrupt existing network sessions and drop in-flight NFS requests.