CVE-2026-72150: sunrpc: fix uninitialized xprt_create_args structure
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: fix uninitialized xprtcreateargs structure
The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore(). While some fields are manually populated, critical fields like srcaddr, bcxps, and flags contain uninitialized stack garbage.
This can lead to: 1. Kernel panic when xssetupxprt() dereferences garbage srcaddr 2. Information leak if srcaddr points to sensitive stack data 3. Unpredictable behavior if flags has random bits set
The fix is to zero-initialize the structure to ensure all unused fields are NULL/0, preventing the transport setup code from acting on garbage data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate by patching the Linux kernel component 'sunrpc' to fix the uninitialized xprt_create_args structure vulnerability ("sunrpc: fix uninitialized xprt_create_args structure"), which resolves information leak when srcaddr points to sensitive stack data and prevents kernel panic when xs_setup_xprt() dereferences garbage srcaddr by zero-initializing the xprt_create_args structure.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72150?
CVE-2026-72150 has a risk score of 50, indicating a moderate level of severity.
How do I fix CVE-2026-72150?
To fix CVE-2026-72150, you should apply the latest patches provided by your Linux distribution.
What systems are affected by CVE-2026-72150?
CVE-2026-72150 affects systems running vulnerable versions of the Linux kernel that utilize the sunrpc module.
What is the impact of CVE-2026-72150?
The impact of CVE-2026-72150 may allow uninitialized memory exposure, potentially leading to information disclosure.
When was CVE-2026-72150 published?
CVE-2026-72150 was published on August 15, 2026.