Improper input validation in Linux kernel - CVE-2026-72465

Vulnerability identifier: #VU142976

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-72465

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in rpcrdma_reply_handler() and rpcrdma_post_recvs() when processing a well-formed reply with an unknown XID and an inflated credit grant. A remote attacker can send a specially crafted reply to cause a denial of service.

The issue occurs because the raw credit value parsed from the wire can reach Receive work request allocation logic without being clamped.

Linux kernel
openEuler
kernel
bpftool
bpftool-debuginfo
kernel-debuginfo
kernel-debugsource
kernel-devel
kernel-extra-modules
kernel-headers
kernel-source
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
perf-debuginfo
python3-perf
python3-perf-debuginfo

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel - update to 6.6.0-145.3.29.160
bpftool - update to 6.6.0-145.3.29.160
bpftool-debuginfo - update to 6.6.0-145.3.29.160
kernel-debuginfo - update to 6.6.0-145.3.29.160
kernel-debugsource - update to 6.6.0-145.3.29.160
kernel-devel - update to 6.6.0-145.3.29.160
kernel-extra-modules - update to 6.6.0-145.3.29.160
kernel-headers - update to 6.6.0-145.3.29.160
kernel-source - update to 6.6.0-145.3.29.160
kernel-tools - update to 6.6.0-145.3.29.160
kernel-tools-debuginfo - update to 6.6.0-145.3.29.160
kernel-tools-devel - update to 6.6.0-145.3.29.160
perf - update to 6.6.0-145.3.29.160
perf-debuginfo - update to 6.6.0-145.3.29.160
python3-perf - update to 6.6.0-145.3.29.160
python3-perf-debuginfo - update to 6.6.0-145.3.29.160

• https://git.kernel.org/stable/c/33db78b1b24fc6a464ae08aa4d2538c5f883eb5e
• https://git.kernel.org/stable/c/41634242140173eabbf54f899f9c70b5c685e786
• https://git.kernel.org/stable/c/469b22376ee73369711ecf2761bd122ef4195963
• https://git.kernel.org/stable/c/7cf332b3d82d73ffceedca6b4a120be074172021
• https://git.kernel.org/stable/c/8be1bb378def94a5cb8f7527a191e476407118ec
• https://git.kernel.org/stable/c/c3a628aab2dc8f5fd7bff86ceaeae64de590e60a

• Improper input validation in Linux kernel sunrpc xprtrdma
• openEuler 24.03 LTS SP3 update for kernel