External risk intelligence

Linux Kernel SunRPC Double-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72220

The vulnerability exists in the Linux kernel sunrpc component. While RPC services can be exposed to the internet, they are frequently restricted to internal network segments or specific authorized clients, and the kernel context implies this is a deep-level subsystem rather than a standard internet-facing application service.

Use After Free

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a resolved vulnerability in the Linux kernel's sunrpc component that could allow an attacker to trigger a double-free or use-after-free condition. This is a critical issue that could potentially lead to system instability or compromise. The main concern is confirming relevance and exposure of internal or external RPC services.

Kernel flaw could cause system instability.
Leadership should remember critical kernel vulnerabilities.
Confirm if internal RPC services are exposed.

Attack Path

How an attacker could exploit the issue

An attacker could trigger a vulnerability in the Linux kernel's RPC request processing by sending specially crafted network requests. If the system encounters an early error during request handling, such as invalid authentication or an unsupported protocol, it may attempt to release resources that have already been freed, leading to a crash or corruption.

Network access required.
Error paths trigger double-free.
System instability and data corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's sunrpc component could allow an attacker to trigger a double-free or use-after-free condition. This could occur when processing RPC requests that encounter specific early errors, potentially leading to system instability or unexpected behavior. There is no indication that this vulnerability directly exposes user data or PII.

Kernel memory integrity.
Malicious RPC requests.
System instability or crashes.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's sunrpc component likely requires action from infrastructure and platform teams responsible for the kernel's maintenance and deployment. The first practical step is to identify all systems running the affected kernel version, determine their network exposure, and confirm business criticality. Subsequently, the accountable owner for each affected system or service should be identified to plan and coordinate remediation efforts, which may involve kernel updates or specific configurations.

Kernel and infrastructure teams own the fix.
Verify system exposure and criticality first.
Plan targeted kernel updates or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel sunrpc component?

The sunrpc component is a foundational part of the Linux kernel that handles Remote Procedure Call (RPC) services. It enables different systems or processes to communicate and execute programs on each other, serving as a core mechanism for network file systems like NFS and various client-server protocols essential for distributed computing.

How does CVE-2026-72220 create a memory vulnerability?

This CVE involves a memory management weakness known as a double-free or use-after-free. It occurs when the kernel attempts to clear or release resources that have already been freed. In this specific case, the flaw exists because the system may incorrectly reuse or attempt to release old memory state from a previous connection if an error occurs early in the processing of a new request.

Does any RPC request trigger this vulnerability?

No. The flaw is not triggered by standard, successful RPC communications. It specifically requires the system to encounter an early error path during request processing—such as receiving a malformed frame, an unsupported protocol, or failing authentication—before the request has been fully initialized.

Is my system at risk if it uses RPC services?

According to Halo Surface Signal, risk depends on accessibility. While RPC services can be internet-facing, they are often isolated within internal network segments or restricted to authorized clients. Because this is a deep-level kernel subsystem, it is less common for it to be exposed directly to the public internet compared to standard user-level applications.

When should I prioritize fixing this kernel issue?

You should prioritize this by first identifying which of your systems run affected kernel versions and determining their network exposure. Since this is a kernel-level vulnerability, coordination between infrastructure and platform teams is necessary to plan updates or apply vendor-provided patches. Focus initial efforts on systems that handle the most critical data or have the widest network reach.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.