Use-after-free in Linux kernel - CVE-2026-72317
Published: August 16, 2026
Vulnerability identifier: #VU143125
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72317
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the SUNRPC TLS connect_worker when handling a failed TLS handshake on a TLS-secured transport. A local user can trigger a failed TLS handshake that causes the upper rpc_clnt to be freed before the queued worker dereferences it to cause a denial of service.
The issue affects the TLS transport path; the non-TLS connect worker does not use the saved client pointer.
Affected software
Linux kernel
How to mitigate CVE-2026-72317
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/46bc86c833956219bbfd246c1ffd832a479c5199
- https://git.kernel.org/stable/c/5b0427ba582d143a364301f825f4e32272f06d2d
- https://git.kernel.org/stable/c/79cd550f8c884523b604fbfa43eb02def74d6224
- https://git.kernel.org/stable/c/7a65b41b657b71d5a77861f47dd13eb4bc8e10d0
- https://git.kernel.org/stable/c/d49f6d098ed48775b9d27a9f9c5c220fdf76f102