CVE-2026-72464

A flaw was found in the kernel's xprtrdma module. A remote attacker can exploit this by sending a sustained stream of malformed Remote Procedure Call over Remote Direct Memory Access (RPC/RDMA) replies. These malformed replies, which are either too short or carry an unrecognized RPC/RDMA version, can drain the client's receive queue. This ultimately leads to a Denial of Service (DoS) condition, causing the transport to stall until a reconnection occurs.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires an established RPC-over-RDMA connection with a rogue or compromised peer, and the outcome is confined to a transport stall rather than system-wide compromise. RPC/RDMA transports, such as NFS over RDMA, are non-default configurations utilized primarily in specialized high-performance clusters. A remote endpoint transmitting truncated or invalid protocol headers can exhaust client receive buffers, resulting in communication stalls until the connection re-establishes, with no compromise to host confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.