{"id":"CVE-2026-72469","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-72469","summary":"xprtrdma: Fix ep kref imbalance on ADDR_CHANGE","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Fix ep kref imbalance on ADDR_CHANGE\n\nrpcrdma_cm_event_handler() falls through to the disconnected: label\non RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no\nmatching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED.\nThe kref then underflows during connect teardown and\nrpcrdma_xprt_disconnect() operates on a freed ep.\n\nReference counts across a normal connection lifecycle:\n\n    rpcrdma_ep_create()             kref_init     ->1\n    rpcrdma_xprt_connect()          ep_get        ->2  (before post_recvs)\n    RDMA_CM_EVENT_ESTABLISHED       ep_get        ->3\n    RDMA_CM_EVENT_DISCONNECTED      ep_put        ->2\n    rpcrdma_xprt_drain()            ep_put        ->1\n    rpcrdma_xprt_disconnect() tail  ep_put        ->0  (ep_destroy)\n\nThe connect-time get in rpcrdma_xprt_connect(), taken just before\nrpcrdma_post_recvs() \"while there are outstanding Receives,\" is\nbalanced by rpcrdma_xprt_drain. ADDR_CHANGE before ESTABLISHED has\nno get to consume, so its put drops the count to 1 and the drain\nput then frees the ep while rpcrdma_xprt_disconnect() still holds a\npointer to it.\n\nFix by dispatching on the prior re_connect_status via xchg(): for\nprev == 0 (pre-ESTABLISHED) wake the connect waiter and return with\nno put; for prev == 1 call rpcrdma_force_disconnect() and return.\nThe case-1 arm relies on the subsequent RDMA_CM_EVENT_DISCONNECTED\nevent -- reliably delivered when rdma_disconnect() is called on a\nstill-connected cm_id -- to balance the ESTABLISHED get;\nrpcrdma_xprt_drain() continues to balance only that connect-time\nget. Any other prior value means teardown is already in flight.","published":"2026-08-15T05:57:11.829Z","modified":"2026-08-16T03:48:48.372583032Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.12.97"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cfd1bab66b042da7a778786685125656c695931b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d0479c2b12974aa188b10d221a5770126b118b6d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ffc07790539736a5d029f6a3c966b46c529f93a8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72469.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72469"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-16T03:48:48.372583032Z"}}