CVE-2026-72220: sunrpc: harden rq_procinfo lifecycle to prevent double-free
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: harden rqprocinfo lifecycle to prevent double-free
The svcreleaserqst() function executes the callback inside rqstp->rqprocinfo->pcrelease. However, if a worker thread begins processing a new request and encounters an early error path (e.g., unsupported protocol, short frame, or bad auth) before a valid rqprocinfo is installed, a stale release hook can be re-triggered against reused state from the previous RPC, resulting in a double-free or use-after-free vulnerability.
Harden the lifecycle of rqprocinfo by: 1. Ensuring svcreleaserqst() always clears rqprocinfo after the optional pcrelease() call, regardless of whether the hook exists. 2. Explicitly clearing rqprocinfo at request entry in svcprocess() before any early decode or drop paths. 3. Ensuring svcprocessbc() does the same at backchannel entry.
This guarantees that error flows will not encounter a non-NULL stale rqprocinfo pointer when there is nothing to release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Patch the Linux kernel sunrpc code to harden rq_procinfo lifecycle as described: ensure svc_process() explicitly clears rq_procinfo at request entry; ensure svc_process_bc() performs the same clearing at backchannel entry; and ensure svc_release_rqst() always clears rq_procinfo after the pc_release() callback/optional hook execution so error/early-decode/drop paths cannot see a non-NULL stale pointer.
Linux kernel (sunrpc) rq_procinfo lifecycle hardening = apply fixes so svc_process() explicitly clears rq_procinfo at request entry and svc_process_bc()/svc_release_rqst() clear/handle rq_procinfo to prevent stale release hooks, double-free, and use-after-free