External risk intelligence

Linux Kernel xprtrdma Req Recycling Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72473

This vulnerability is located in the Linux kernel's xprtrdma subsystem, which handles Remote Direct Memory Access (RDMA) communication. These operations occur at a deep, low-level internal layer of the operating system. They are not exposed to the public internet and are intended for internal host-to-host or cluster communication rather than external service interaction.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recent security flaw in the Linux kernel's RDMA subsystem has been addressed. This issue could have potentially led to system instability or data corruption if exploited, though the complexity of the affected subsystem and its typical use cases suggest a limited direct impact on externally facing services. The primary concern is to confirm if this specific internal kernel function is in use within your environment.

A kernel flaw that could cause instability.
Affects internal system communication, not external services.
Confirm relevance and exposure within your environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by triggering a race condition in the Linux kernel's xprtrdma component. This occurs when handling network requests involving RDMA, potentially leading to memory corruption and system compromise. The vulnerability lies in how the kernel manages the lifecycle of network request structures, allowing them to be prematurely released while still in use by hardware.

Vulnerability is in the Linux kernel's RDMA subsystem.
Race condition related to request recycling.
Memory corruption leading to system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's xprtrdma component could allow for a race condition during request recycling. When certain conditions are met, a request could be returned to the free pool before DMA operations are complete, potentially leading to data corruption or system instability when supported by the advisory.

Memory corruption or system instability.
Race condition during request recycling.
Undefined behavior or crashes.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in the Linux kernel's xprtrdma component, a low-level subsystem for internal communication. Typically, infrastructure or platform teams manage the Linux kernel. The first step is to identify all systems running the affected kernel version, determine their exposure and criticality, and then assign ownership for remediation planning.

Infrastructure or platform teams own this.
Verify kernel reachability and criticality.
Plan remediation in maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel xprtrdma component?

The xprtrdma component is a low-level subsystem within the Linux kernel that enables Remote Direct Memory Access (RDMA). This technology allows for high-speed, low-latency data transfers by letting a computer access memory on another computer directly without involving the operating system of either, primarily for internal communication between servers in high-performance clusters.

What is the weakness in CVE-2026-72473?

This vulnerability is a race condition related to improper resource management. It occurs when the kernel prematurely recycles a network request structure before the hardware has finished performing direct memory operations with it. This overlap can lead to memory corruption, where data is accessed or modified unexpectedly, potentially resulting in system instability.

How can an attacker trigger this vulnerability?

An attacker needs to interact with the RDMA subsystem's request lifecycle process to induce the race condition. This does not happen through common user-space applications or simple network requests; it requires specific, complex timing where a memory buffer is freed while hardware DMA operations are still active. It is not triggered by standard traffic or basic service interactions.

Is my system at risk according to Halo Surface Signal?

The risk is considered very unlikely. Halo Surface Signal identifies that this vulnerability exists in a deep, internal kernel layer meant for host-to-host or cluster communication. Because these operations are not exposed directly to the public internet, the attack surface for this issue is restricted to local or internal network interactions, rather than external service access.

What should I do to address CVE-2026-72473?

First, identify which systems in your environment are running the affected Linux kernel versions. Coordinate with your infrastructure or platform engineering teams to assess the criticality of these systems. Plan to apply the relevant kernel updates during your next scheduled maintenance window to ensure the vulnerability is remediated correctly.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.