CVE-2026-72217: Linux Vulnerability (CVSS 9.8)

Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing xdr_buf_to_bvec() writes a bio_vec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the caller's budget is exactly used up, the next store lands one element past the end of the array. The overflow label returns count - 1, which masks the surplus store but cannot undo it. rq_bvec, the array passed by nfsd_vfs_write(), is allocated to exactly rq_maxpages entries with no slack. The OOB store can land in adjacent slab memory; the bv_len and bv_offset fields written there are derived from client-supplied RPC payload sizes. Move the in-range check ahead of the store in the head, page-loop, and tail branches. With the check at the top of each sequence, count is incremented only after a successful store, so the overflow label can return count directly.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.20%

10.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 2eb2b93581813b74c7174961126f6ec38eadb5a7, < 4a1148f2739d5089c3ca8ae2e9d1053e219ab5df; >= 2eb2b93581813b74c7174961126f6ec38eadb5a7, < 6029e711a818bf34d6c4b90cafee24f3afffa110; >= 2eb2b93581813b74c7174961126f6ec38eadb5a7, < 69e18135e2a004a79505451dbef07314ea16e1eb; >= 2eb2b93581813b74c7174961126f6ec38eadb5a7, < 98414b42530af65cb984ffc12685096a3b5e179a; >= 2eb2b93581813b74c7174961126f6ec38eadb5a7, < 42f5b80dda6b86e424054baf1475df686c403d5c
Linux	Linux	6.6

References

Timeline

Published: Aug 15, 2026
Last Modified: Aug 17, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-72217?

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing xdr_buf_to_bvec() writes a bio_vec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the caller's budget is exactly used up, the next store lands one element past the end of the array. The overflow label returns count - 1, which masks the surplus store but cannot undo it. rq_bvec, the array passed by nfsd_vfs_write(), is allocated to exactly rq_maxpages entries with no slack. The OOB store can land in adjacent slab memory; the bv_len and bv_offset fields written there are derived from client-supplied RPC payload sizes. Move the in-range check ahead of the store in the head, page-loop, and tail branches. With the check at the top of each sequence, count is incremented only after a successful store, so the overflow label can return count directly.

How severe is CVE-2026-72217?

CVE-2026-72217 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.20% probability of exploitation in the next 30 days.

How do I fix CVE-2026-72217?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →