CVE-2026-72469

A flaw was found in the xprtrdma component of the Linux kernel. An attacker could potentially exploit a use-after-free vulnerability due to an improper handling of Remote Direct Memory Access (RDMA) connection events. Specifically, an address change event occurring before a connection is fully established can lead to an imbalance in reference counting, causing the system to attempt to use memory that has already been released. This could result in system instability or crashes.

This vulnerability is rated as Moderate impact because triggering it requires an active RDMA network configuration and specific timing during connection establishment, preventing exploitation on default installations. In standard Red Hat Enterprise Linux environments, RPC-over-RDMA is not enabled by default and is limited to specialized high-performance clusters. When triggered, the reference count imbalance can cause a kernel panic, resulting in a denial of service without compromising system integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.