{"api_version":"1","generated_at":"2026-08-15T10:15:03+00:00","cve":"CVE-2026-72465","urls":{"html":"https://cve.report/CVE-2026-72465","api":"https://cve.report/api/cve/CVE-2026-72465.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72465","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72465"},"summary":{"title":"xprtrdma: Sanitize the reply credit grant after parsing","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Sanitize the reply credit grant after parsing\n\nThe out_norqst exit in rpcrdma_reply_handler() branches away before\nthe credit clamp, so a reply that matches no pending request reaches\nout_post carrying the raw credit value parsed from the wire.\nrpcrdma_post_recvs() does not bound its @needed argument: the refill\nloop allocates and chains Receive WRs until the count is satisfied or\nallocation fails. A peer that sends a well-formed reply carrying an\nunknown XID and an inflated credit grant therefore drives rep\nallocation and Receive posting past re_max_requests on every such\nreply.\n\nMove the clamp to immediately after the credit field is parsed,\nahead of the first branch that can reach out_post, so every later\nconsumer sees a sanitized value. The cwnd update stays on the\nmatched-request path.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:22:20","updated_at":"2026-08-15 06:22:20"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/33db78b1b24fc6a464ae08aa4d2538c5f883eb5e","name":"https://git.kernel.org/stable/c/33db78b1b24fc6a464ae08aa4d2538c5f883eb5e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7cf332b3d82d73ffceedca6b4a120be074172021","name":"https://git.kernel.org/stable/c/7cf332b3d82d73ffceedca6b4a120be074172021","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c3a628aab2dc8f5fd7bff86ceaeae64de590e60a","name":"https://git.kernel.org/stable/c/c3a628aab2dc8f5fd7bff86ceaeae64de590e60a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/41634242140173eabbf54f899f9c70b5c685e786","name":"https://git.kernel.org/stable/c/41634242140173eabbf54f899f9c70b5c685e786","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/469b22376ee73369711ecf2761bd122ef4195963","name":"https://git.kernel.org/stable/c/469b22376ee73369711ecf2761bd122ef4195963","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8be1bb378def94a5cb8f7527a191e476407118ec","name":"https://git.kernel.org/stable/c/8be1bb378def94a5cb8f7527a191e476407118ec","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72465","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72465","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d01d6670c169316115b26dfb3585a73dfe40b563 7cf332b3d82d73ffceedca6b4a120be074172021 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d1b159356a3584943192712392fcb2439aafb8c1 41634242140173eabbf54f899f9c70b5c685e786 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 17da9e0caa8615f6fc3b4022eadbd78a9aea1a2a 8be1bb378def94a5cb8f7527a191e476407118ec git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e7ae0883c8c89b901226de43862184bf37054338 469b22376ee73369711ecf2761bd122ef4195963 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 704f3f640f72db4d44ec5ce3db8d4e150c974bc7 33db78b1b24fc6a464ae08aa4d2538c5f883eb5e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 704f3f640f72db4d44ec5ce3db8d4e150c974bc7 c3a628aab2dc8f5fd7bff86ceaeae64de590e60a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.1","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sunrpc/xprtrdma/rpc_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7cf332b3d82d73ffceedca6b4a120be074172021","status":"affected","version":"d01d6670c169316115b26dfb3585a73dfe40b563","versionType":"git"},{"lessThan":"41634242140173eabbf54f899f9c70b5c685e786","status":"affected","version":"d1b159356a3584943192712392fcb2439aafb8c1","versionType":"git"},{"lessThan":"8be1bb378def94a5cb8f7527a191e476407118ec","status":"affected","version":"17da9e0caa8615f6fc3b4022eadbd78a9aea1a2a","versionType":"git"},{"lessThan":"469b22376ee73369711ecf2761bd122ef4195963","status":"affected","version":"e7ae0883c8c89b901226de43862184bf37054338","versionType":"git"},{"lessThan":"33db78b1b24fc6a464ae08aa4d2538c5f883eb5e","status":"affected","version":"704f3f640f72db4d44ec5ce3db8d4e150c974bc7","versionType":"git"},{"lessThan":"c3a628aab2dc8f5fd7bff86ceaeae64de590e60a","status":"affected","version":"704f3f640f72db4d44ec5ce3db8d4e150c974bc7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sunrpc/xprtrdma/rpc_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc1","versionStartIncluding":"7.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Sanitize the reply credit grant after parsing\n\nThe out_norqst exit in rpcrdma_reply_handler() branches away before\nthe credit clamp, so a reply that matches no pending request reaches\nout_post carrying the raw credit value parsed from the wire.\nrpcrdma_post_recvs() does not bound its @needed argument: the refill\nloop allocates and chains Receive WRs until the count is satisfied or\nallocation fails. A peer that sends a well-formed reply carrying an\nunknown XID and an inflated credit grant therefore drives rep\nallocation and Receive posting past re_max_requests on every such\nreply.\n\nMove the clamp to immediately after the credit field is parsed,\nahead of the first branch that can reach out_post, so every later\nconsumer sees a sanitized value. The cwnd update stays on the\nmatched-request path."}],"providerMetadata":{"dateUpdated":"2026-08-15T05:57:08.767Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/7cf332b3d82d73ffceedca6b4a120be074172021"},{"url":"https://git.kernel.org/stable/c/41634242140173eabbf54f899f9c70b5c685e786"},{"url":"https://git.kernel.org/stable/c/8be1bb378def94a5cb8f7527a191e476407118ec"},{"url":"https://git.kernel.org/stable/c/469b22376ee73369711ecf2761bd122ef4195963"},{"url":"https://git.kernel.org/stable/c/33db78b1b24fc6a464ae08aa4d2538c5f883eb5e"},{"url":"https://git.kernel.org/stable/c/c3a628aab2dc8f5fd7bff86ceaeae64de590e60a"}],"title":"xprtrdma: Sanitize the reply credit grant after parsing","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72465","datePublished":"2026-08-15T05:57:08.767Z","dateReserved":"2026-08-09T03:40:39.933Z","dateUpdated":"2026-08-15T05:57:08.767Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:22:20","lastModifiedDate":"2026-08-15 06:22:20","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72465","Ordinal":"1","Title":"xprtrdma: Sanitize the reply credit grant after parsing","CVE":"CVE-2026-72465","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72465","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Sanitize the reply credit grant after parsing\n\nThe out_norqst exit in rpcrdma_reply_handler() branches away before\nthe credit clamp, so a reply that matches no pending request reaches\nout_post carrying the raw credit value parsed from the wire.\nrpcrdma_post_recvs() does not bound its @needed argument: the refill\nloop allocates and chains Receive WRs until the count is satisfied or\nallocation fails. A peer that sends a well-formed reply carrying an\nunknown XID and an inflated credit grant therefore drives rep\nallocation and Receive posting past re_max_requests on every such\nreply.\n\nMove the clamp to immediately after the credit field is parsed,\nahead of the first branch that can reach out_post, so every later\nconsumer sees a sanitized value. The cwnd update stays on the\nmatched-request path.","Type":"Description","Title":"xprtrdma: Sanitize the reply credit grant after parsing"}]}}}