Answer in brief
CVE-2026-72465 records a Unknown severity vulnerability in xprtrdma: Sanitize the reply credit grant after parsing. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d01d6670c169316115b26dfb3585a73dfe40b563 <7cf332b3d82d73ffceedca6b4a120be074172021 || >=d1b159356a3584943192712392fcb2439aafb8c1 <41634242140173eabbf54f899f9c70b5c685e786 || >=17da9e0caa8615f6fc3b4022eadbd78a9aea1a2a <8be1bb378def94a5cb8f7527a191e476407118ec || >=e7ae0883c8c89b901226de43862184bf37054338 <469b22376ee73369711ecf2761bd122ef4195963 || >=704f3f640f72db4d44ec5ce3db8d4e150c974bc7 <33db78b1b24fc6a464ae08aa4d2538c5f883eb5e || >=704f3f640f72db4d44ec5ce3db8d4e150c974bc7 <c3a628aab2dc8f5fd7bff86ceaeae64de590e60a | 7cf332b3d82d73ffceedca6b4a120be074172021, 41634242140173eabbf54f899f9c70b5c685e786, 8be1bb378def94a5cb8f7527a191e476407118ec, 469b22376ee73369711ecf2761bd122ef4195963, 33db78b1b24fc6a464ae08aa4d2538c5f883eb5e, c3a628aab2dc8f5fd7bff86ceaeae64de590e60a |
| Linux/Linuxgeneric | 7.1 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The out_norqst exit in rpcrdma_reply_handler() branches away before the credit clamp, so a reply that matches no pending request reaches out_post carrying the raw credit value parsed from the wire. rpcrdma_post_recvs() does not bound its @needed argument: the refill loop allocates and chains Receive WRs until the count is satisfied or allocation fails. A peer that sends a well-formed reply carrying an unknown XID and an inflated credit grant therefore drives rep allocation and Receive posting past re_max_requests on every such reply. Move the clamp to immediately after the credit field is parsed, ahead of the first branch that can reach out_post, so every later consumer sees a sanitized value. The cwnd update stays on the matched-request path.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-72465 records a Unknown severity vulnerability in xprtrdma: Sanitize the reply credit grant after parsing. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d01d6670c169316115b26dfb3585a73dfe40b563 <7cf332b3d82d73ffceedca6b4a120be074172021 || >=d1b159356a3584943192712392fcb2439aafb8c1 <41634242140173eabbf54f899f9c70b5c685e786 || >=17da9e0caa8615f6fc3b4022eadbd78a9aea1a2a <8be1bb378def94a5cb8f7527a191e476407118ec || >=e7ae0883c8c89b901226de43862184bf37054338 <469b22376ee73369711ecf2761bd122ef4195963 || >=704f3f640f72db4d44ec5ce3db8d4e150c974bc7 <33db78b1b24fc6a464ae08aa4d2538c5f883eb5e || >=704f3f640f72db4d44ec5ce3db8d4e150c974bc7 <c3a628aab2dc8f5fd7bff86ceaeae64de590e60a | 7cf332b3d82d73ffceedca6b4a120be074172021, 41634242140173eabbf54f899f9c70b5c685e786, 8be1bb378def94a5cb8f7527a191e476407118ec, 469b22376ee73369711ecf2761bd122ef4195963, 33db78b1b24fc6a464ae08aa4d2538c5f883eb5e, c3a628aab2dc8f5fd7bff86ceaeae64de590e60a |
| Linux/Linuxgeneric | 7.1 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The out_norqst exit in rpcrdma_reply_handler() branches away before the credit clamp, so a reply that matches no pending request reaches out_post carrying the raw credit value parsed from the wire. rpcrdma_post_recvs() does not bound its @needed argument: the refill loop allocates and chains Receive WRs until the count is satisfied or allocation fails. A peer that sends a well-formed reply carrying an unknown XID and an inflated credit grant therefore drives rep allocation and Receive posting past re_max_requests on every such reply. Move the clamp to immediately after the credit field is parsed, ahead of the first branch that can reach out_post, so every later consumer sees a sanitized value. The cwnd update stays on the matched-request path.
Quoted source text, attributed separately from HOL analysis.