CVE-2026-72166
Description
A flaw was found in the Linux kernel's 9p client remote procedure call (RPC) implementation. When the p9_client_rpc() function is called with a P9_TFLUSH request and the transport has no peer, a fatal signal can cause an infinite loop. This prevents the affected process from terminating, leading to a permanent hang and a denial of service. This issue can be triggered, for example, during coredump operations.
Statement
Red Hat has evaluated this issue as having a Low impact because exploitation is restricted to local systems using the Plan 9 network protocol and requires a specific failure state where transport communication is severed without an active peer. In default Red Hat Enterprise Linux configurations, 9p client mounts are not actively utilized or enabled. While an unhandled fatal signal under these conditions can cause the calling thread to enter an uninterruptible sleep state during core dump or termination processing, this results strictly in a localized denial of service without compromising host confidentiality, integrity, or privileges.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
