CVE-2026-72317

A flaw was found in the Linux kernel's SUN Remote Procedure Call (SUNRPC) implementation. A use-after-free vulnerability exists in the Transport Layer Security (TLS) connection path. When a TLS handshake fails, the client resource can be prematurely freed, leading to a subsequent attempt to access the freed memory. This can result in a system crash, causing a denial of service.

This vulnerability is rated as Moderate severity rather than Important because triggering it requires non-default RPC-over-TLS transports and an unrecoverable handshake failure, restricting the impact to a denial of service (system crash). In typical Red Hat Enterprise Linux environments, RPC clients and NFS mounts do not enable TLS-secured transports by default. The issue is only encountered when an encrypted connection attempt fails fatally, resulting in an unpinned data structure dereference during delayed connection handling.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.