UBUNTU-CVE-2026-72468: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid() registers ep->rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate(). However rpcrdmaepcreate() currently stores that pointer in ep->reid only after rpcrdmacreateid() returns. A local administrator can race an NFS/RDMA mount against RDMA device removal. If rpcrdmaremoveone() observes the just-registered notification before rpcrdmaepcreate() assigns ep->reid, rpcrdmaepremovaldone() calls tracexprtrdmadeviceremoval(NULL). The tracepoint dereferences id->device->name and copies id->route.addr.dstaddr, so the callback can crash the kernel with a NULL pointer dereference. Store the rdmacmid in ep->reid immediately before publishing ep->rern. The existing error path still destroys the id directly if registration fails; ep is then freed by the caller without using ep->reid. Remove the later duplicate assignment in rpcrdmaepcreate().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1
Event History
Frequently Asked Questions
Who can trigger this issue?
A local administrator who can race an NFS/RDMA mount operation with removal of an RDMA device can trigger the NULL pointer dereference.
What is the impact of successful exploitation?
The affected removal callback can invoke a tracepoint with a NULL RDMA connection-manager ID, causing the kernel to crash through a NULL pointer dereference.
What conditions are required for the race?
An NFS/RDMA mount must be in progress while an RDMA device is being removed, and the device-removal notification must occur after registration but before the RDMA connection-manager ID is stored in the endpoint.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.