External risk intelligence

Linux Kernel xprtrdma Buffer Leak and Receive Queue Drain

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72466

This vulnerability exists in the Linux kernel's RPC-over-RDMA (xprtrdma) implementation. RDMA (Remote Direct Memory Access) is typically used in high-performance, private data center interconnects or cluster networks. While it is network-reachable, it is not a common protocol exposed directly to the public internet in typical deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This Linux kernel vulnerability in the RPC-over-RDMA component could allow an unauthenticated attacker to cause a denial-of-service condition by consuming memory resources. The issue stems from how malformed network replies are handled, potentially leading to a continuous drain of the receive queue, impacting system stability and network performance. The main concern is confirming relevance and exposure, as this functionality is typically found in specialized high-performance networking environments rather than broadly exposed systems.

An issue in Linux kernel network handling.
Matters if using specialized high-performance networks.
Confirm relevance and exposure of this feature.

Attack Path

How an attacker could exploit the issue

An attacker could reach a vulnerability in the Linux kernel's RPC-over-RDMA component by sending specially crafted reply messages. These malformed replies could cause the system to misinterpret them, leading to resource leaks and the draining of its receive queue. This could potentially result in denial-of-service conditions and other impacts.

Network access is required.
Malformed reply messages trigger the vulnerability.
Can lead to resource leaks and queue draining.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the Linux kernel's RPC-over-RDMA (xprtrdma) implementation. Specifically, it may lead to the leakage of receive buffers and the draining of the receive queue when handling malformed or short network replies. This could occur when an attacker sends specially crafted network packets to a system utilizing this kernel functionality.

Network receive buffers could be leaked.
Malformed replies could cause buffer leaks.
Service disruptions and network issues may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's RPC-over-RDMA implementation likely impacts infrastructure or platform teams responsible for high-performance computing or clustered environments. The first practical step is to identify any systems utilizing RPC-over-RDMA, assess their network exposure and business criticality, and then determine the accountable owner for remediation planning.

Identify RPC-over-RDMA deployments.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel's xprtrdma component?

The xprtrdma component is the Linux kernel's implementation of Remote Direct Memory Access (RDMA) for Remote Procedure Calls. It allows systems to exchange data directly between memory regions over high-speed networks, bypassing the traditional operating system stack to achieve lower latency and higher performance in data centers or clustered environments.

How does CVE-2026-72466 cause a service issue?

This vulnerability involves improper input validation in network reply processing. When the system receives a malformed or short reply, it incorrectly handles the data, leading to memory leaks and the exhaustion of the receive queue. This prevents the system from processing legitimate incoming messages, resulting in a denial-of-service state where network communication stalls.

What triggers this xprtrdma vulnerability?

An attacker must send a specially crafted, malformed network reply to a system using the xprtrdma transport. The bug is triggered when the kernel misinterprets this packet as a backchannel call due to flawed decoding logic. Normal, well-formed RPC-over-RDMA traffic does not trigger this issue, as the bug relies on the kernel's mishandling of unexpectedly short or truncated headers.

Is my system at risk for CVE-2026-72466?

Risk is limited to systems configured to use RPC-over-RDMA. Halo Surface Signal notes that while this vulnerability is network-reachable, RDMA protocols are typically restricted to internal high-performance or private cluster networks rather than the public internet. You should assess if your infrastructure supports these specialized, high-bandwidth interconnects to determine relevance.

What are the first steps to address this kernel flaw?

Start by identifying all servers in your environment that have the xprtrdma transport enabled. Once identified, evaluate whether these systems reside on segmented, private networks or have broader connectivity. Consult your organization's Linux kernel maintenance procedures to plan for an update, prioritizing systems that support critical infrastructure or clustered workloads.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.