External risk intelligence

Linux Kernel SUNRPC TLS Use-After-Free

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72317

This vulnerability exists in the Linux kernel's SUNRPC layer regarding TLS connection handling. While network-related, these RPC operations are typically performed within internal infrastructure, between specific hosts, or in backend storage/NFS configurations rather than as directly exposed public-internet services.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability within the Linux kernel's SUNRPC component that could lead to a use-after-free error during TLS connection establishment. This issue arises when a TLS handshake fails, potentially causing the system to attempt to access memory that has already been freed. The main concern is confirming relevance and exposure within the specific Linux kernel environments utilized.

A flaw exists in how secure connections are managed.
It affects specific Linux kernel operations.
Confirm relevance and exposure for your Linux systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by triggering a specific network operation within the Linux kernel's SUNRPC layer. This operation, when handling TLS-secured transports, involves a race condition where a client pointer can be freed prematurely. If a TLS handshake fails and the connection is subsequently shut down, the system might attempt to use the already freed pointer, leading to a crash or potential for further compromise.

Entry condition: Network access to a vulnerable system.
Trigger point: Initiating a TLS connection that subsequently fails.
Resulting risk: System instability or potential for arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the stability of network services that use TLS-secured SUNRPC connections within the Linux kernel. If a TLS handshake fails, a race condition might occur, leading to a crash when the system attempts to use a now-invalid client connection. This could disrupt the availability of services relying on these connections.

System stability of RPC services.
TLS handshake failure may trigger a crash.
Service disruption or unavailability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's SUNRPC component impacts TLS-secured transport connections. Given its nature within the kernel and networking stack, infrastructure or platform teams responsible for managing Linux systems and their network services are likely owners. The initial step involves identifying all systems utilizing the affected kernel version, determining their exposure and criticality, and then coordinating with relevant teams for remediation, potentially involving vendor engagement if commercial Linux distributions are in use.

Infrastructure or platform teams should own.
Verify Linux kernel and TLS transport usage.
Plan remediation during scheduled maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel SUNRPC component?

SUNRPC, or Sun Remote Procedure Call, is a fundamental networking protocol layer in the Linux kernel. It provides the mechanism for systems to communicate and request services from one another, such as in Network File System (NFS) operations or distributed storage configurations where data is shared across a network.

What is the nature of the CVE-2026-72317 vulnerability?

This is a use-after-free vulnerability occurring during TLS-secured network operations. It happens when the system tries to access memory that has already been deallocated, which can occur if a secure TLS handshake fails and the system incorrectly attempts to process data related to that closed connection.

How is this bug triggered?

The flaw is triggered specifically when a TLS-secured RPC connection fails. If a handshake ends abruptly, a race condition may cause the kernel to use a freed pointer. Non-TLS connections are not affected by this specific memory issue, as they do not perform the same operation when managing connection failures.

Do I need to worry if my service is not internet-facing?

According to Halo Surface Signal, this vulnerability is unlikely to be a direct internet threat because these RPC operations usually occur within backend, internal, or infrastructure-level communications. While the vulnerability exists, the risk is typically contained to systems interacting within your private network or storage environment.

How should I respond to this advisory?

Begin by identifying which of your Linux systems are running the affected kernel versions and utilizing TLS-secured RPC transports. Since this is a kernel-level issue, coordinate with your infrastructure or platform teams to plan for patching or kernel updates as part of your standard maintenance cycles, or consult your Linux distribution vendor for specific guidance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.