CVE-2026-72491

A flaw was found in the Linux kernel's net/9p RDMA transport module. An inconsistent locking mechanism around the rdma->state field allows for a race condition during connection teardown. This can lead to lost state transitions, corrupting the connection state machine. Consequently, a use-after-free vulnerability may occur on RDMA request objects, potentially resulting in a denial of service or arbitrary code execution.

This vulnerability is rated as having a Moderate impact because exploiting it requires an active 9P connection over an RDMA transport, an uncommon setup in standard enterprise environments. While the locking oversight during teardown can induce memory corruption, successful exploitation demands precise timing across concurrent kernel threads. Consequently, the realistic impact is predominantly confined to localized system instability and denial of service rather than reliable privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.