CVE-2026-72467

A flaw was found in the Linux kernel's xprtrdma module. The system fails to properly check the return value of frwr_wp_create(), which is responsible for creating a Memory Region. If this creation fails, a subsequent Network File System (NFS) over Remote Direct Memory Access (RDMA) read operation with an unaligned receive page length can lead to a NULL pointer dereference. This can result in a system crash, causing a denial of service, and is locally triggerable on an NFS/RDMA client.

This vulnerability is rated as Low severity because triggering it requires specialized NFS over RDMA client deployments along with rare local memory registration failures during connection establishment, preventing remote exploitation. Standard Red Hat Enterprise Linux installations do not configure NFS over RDMA by default, significantly limiting exposure across typical environments. Furthermore, because a remote host cannot induce the required local setup failure, an attacker cannot exploit this condition over the network.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.