Out-of-bounds read in Linux kernel - CVE-2026-72466

Vulnerability identifier: #VU142977

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-72466

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read and improper resource management in rpcrdma_is_bcall() when processing a short or malformed reply. A remote attacker can send a specially crafted reply to cause a denial of service.

The issue can misclassify a reply as a backchannel call and orphan a persistently DMA-mapped receive buffer, which can drain the Receive queue and lead to RNR NAKs in the peer.

Linux kernel
openEuler
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel-source
kernel-headers
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
bpftool
kernel
kernel-extra-modules

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
python3-perf-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
python3-perf - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
perf-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
perf - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-tools-devel - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-tools-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-tools - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-source - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-headers - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-devel - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-debugsource - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
bpftool-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
bpftool - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-extra-modules - update to 6.6.0-145.3.29.160

• https://git.kernel.org/stable/c/07aa506436be7634e381e1e1f6d0efa9efc81ecc
• https://git.kernel.org/stable/c/0cee8f9c3b14bd6dee9c4310090a7f45b89b834f
• https://git.kernel.org/stable/c/118a16a18c59f7ad8084b2d13988839b669fca10
• https://git.kernel.org/stable/c/7afc2f8d2fd9394724df9eaf22ce7a71029a5fba
• https://git.kernel.org/stable/c/88b5346284a184a6b7d019912232a571d672d3e3
• https://git.kernel.org/stable/c/c7653d5cebc8492c77ec0415b5e9c0fb3e644bc6
• https://git.kernel.org/stable/c/d7a2870dde3bb09d51d6b9c877642996ad6b92dd

• Out-of-bounds read in Linux kernel sunrpc xprtrdma
• openEuler 24.03 LTS SP3 update for kernel
• openEuler 24.03 LTS SP1 update for kernel