CVE-2026-72473

A flaw was found in the xprtrdma module of the Linux kernel. This vulnerability involves an issue with how the system manages references to data requests, potentially allowing a request to be released while it is still actively being used by the hardware. This improper handling of resources could lead to memory corruption, which an attacker might leverage to cause system instability or a denial of service (DoS).

A lifetime race in xprtrdma can recycle an rpcrdma_req before the RDMA Send side has completed. This can happen when a Reply completes the RPC and drops the shared rl_kref while the HCA may still be DMA reading from the Send buffer, especially for Sends that use only pre registered buffers and do not need DMA unmap through sc_unmap_count. This is a DMA use-after-free style condition in the RPC/RDMA transport and can lead to kernel crash, corrupted RPC state, or exposure of data that is read from a reused Send buffer. For the CVSS the PR:N value is used for the paranoid score because a malicious or compromised RPC/RDMA peer on the adjacent RDMA fabric may be able to influence Reply timing without privileges on the victim host. The issue is not Internet remote in typical deployments and usually requires access to an internal RDMA or storage network.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.