CVE-2026-72473— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 5.3版本存在安全漏洞，该漏洞源于xprtrdma中rl_kref引用计数管理不当，可能导致请求在硬件仍读取发送缓冲区时被释放，造成释放后重用。
可能的 ATT&CK 技术 1 AI
T1135 · Network Share Discovery影响版本矩阵 14
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 0ab115237025f5e379620bbcd56a02697d07b002< 740975054a1970c0cf15f70ac39724a064f45847 |
affected |
0ab115237025f5e379620bbcd56a02697d07b002< 9f3d9b68c1c6c51746e5ecdb52b2e6a2901de37e |
affected | ||
0ab115237025f5e379620bbcd56a02697d07b002< e7632089523acddcdd8f090ad19e96fb3107b04d |
affected | ||
0ab115237025f5e379620bbcd56a02697d07b002< 53442c7d0c888e51b8bc3da196970a669cc6b294 |
affected | ||
0ab115237025f5e379620bbcd56a02697d07b002< 8203f760a72bd39a3b66bc4eff0aa272a99fe22b |
affected | ||
0ab115237025f5e379620bbcd56a02697d07b002< e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3 |
affected | ||
5.3 |
affected | ||
< 5.3 |
unaffected | ||
| … +6 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-72473 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
xprtrdma: Decouple req recycling from RPC completion
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
xprtrdma: Decouple req recycling from RPC completion
rl_kref formerly served two distinct lifetimes through a single
refcount: it gated when a Reply could wake its RPC task, and it
gated when an rpcrdma_req could return to its free pool. The
marshal path took the Send-side reference only when SGEs needed
DMA-unmap (sc_unmap_count > 0), which made a Send carrying only
pre-registered buffers an exception: the Reply handler dropped
rl_kref from 1 to 0 and freed the req while the HCA might still
be DMA-reading from its send buffer.
Give rl_kref a narrower job. The RPC layer takes one reference
when slot allocation hands a req out. rpcrdma_prepare_send_sges()
takes a Send-side reference unconditionally after WR preparation
succeeds. xprt_rdma_free_slot() and xprt_rdma_bc_free_rqst() drop
the RPC-layer reference; rpcrdma_sendctx_unmap() drops the
Send-side reference. The req returns to its free pool only after
both owners have signed off.
The existing kref_init(&req->rl_kref) call in
rpcrdma_prepare_send_sges() is removed. Initialization moves to
the slot-allocation paths (xprt_rdma_alloc_slot and
rpcrdma_bc_rqst_get), and the release callback re-arms rl_kref
before the req returns to a free pool. A re-init in the marshal
path would discard the RPC-layer reference that already exists
on entry.
Three invariants follow:
- Any rpcrdma_req held by an rpc_rqst has rl_kref >= 1.
xprt_rdma_alloc_slot(), rpcrdma_bc_rqst_get(), and the
backlog-wake branch in xprt_rdma_alloc_slot() each kref_init
rl_kref before publishing the req. Without this invariant,
an RPC task that aborts between slot allocation and marshal
(gss_refresh failure or signal during call_connect, for
example) would drive xprt_release() ->
xprt_rdma_free_slot() -> kref_put against a refcount of
zero, saturating refcount_t and stranding the slot.
- The Send-side reference is taken only after WR prep
succeeds. A mapping failure in rpcrdma_prepare_send_sges()
runs rpcrdma_sendctx_cancel(), which DMA-unmaps the sendctx
and clears sc_req without touching rl_kref. The sendctx
ring walks in rpcrdma_sendctx_put_locked() and
rpcrdma_sendctxs_destroy() skip entries with sc_req == NULL,
so a burst of -EIO marshal failures cannot hold reqs off
rb_send_bufs.
- The release callback re-arms rl_kref so the next consumer
enters with the invariant satisfied.
Replies now complete the RPC directly. rpcrdma_reply_handler()
calls rpcrdma_complete_rqst() in place of kref_put on the
non-LocalInv branch. The LocalInv branch already completes the
RPC from frwr_unmap_async() and is unaffected.
Because Send-side references can now outlive RPC completion,
connection teardown drains sendctx entries whose unsignaled
Sends never had a later signaled completion to walk the ring.
rpcrdma_sendctxs_destroy() walks the active range and runs
rpcrdma_sendctx_unmap() on each entry with a non-NULL sc_req
before the request buffers are reset, and is moved ahead of
rpcrdma_reqs_reset() in rpcrdma_xprt_disconnect() so the reqs
are still in their pre-reset state when the Send-side refs are
released.
The drain creates a teardown-ordering hazard on the backchannel
path. With the new lifetime, releasing a bc_prealloc req from
rpcrdma_req_release() re-adds it to bc_pa_list. The disconnect
in xprt_rdma_destroy() runs after xprt_destroy_backchannel() has
already emptied bc_pa_list, so the drained reqs would otherwise
leak. xprt_rdma_destroy() now runs xprt_rdma_bc_destroy(xprt, 0)
a second time after the disconnect to reclaim them.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 5.3版本存在安全漏洞，该漏洞源于xprtrdma中rl_kref引用计数管理不当，可能导致请求在硬件仍读取发送缓冲区时被释放，造成释放后重用。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-72473 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-72473 的情报信息
请登录查看更多情报信息。
CVE-2026-72473 补丁与修复 (6)
同批安全公告 · Linux · 2026-08-15 · 共 844 条
| CVE-2026-74279 | 10.0 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-74280 | 10.0 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-72421 | 10.0 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-74475 | 10.0 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-72408 | 10.0 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-72407 | 10.0 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-74309 | 10.0 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-72493 | 9.9 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-72084 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-74480 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-72083 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-74345 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-72248 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-72249 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-74493 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-74495 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-72251 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-74398 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-74401 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-72317 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
显示前 20 条，共 844 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-72473
暂无评论