CVE-2026-72220

A stale rq_procinfo pointer in a reused SUNRPC server request object can cause svc_release_rqst() to invoke a previous pc_release callback against already released or reused RPC state, resulting in a double-free or use-after-free. A remote client may trigger the condition when a previous RPC installs a valid rq_procinfo and a subsequent request on the reused svc_rqst reaches an early error path, such as a short frame, unsupported protocol, or authentication failure, before a new procedure descriptor is installed.

For CVSS, AV:N/PR:N is used because an attacker can reach the vulnerable request-processing path remotely when an affected SUNRPC service is exposed, and the triggering error can occur before successful authentication. Practical exploitation has additional state-dependent complexity because it requires reuse of request state from a preceding RPC followed by an appropriate early-failing request. Exposure is primarily relevant to systems providing kernel SUNRPC services, such as NFS server deployments, which are commonly restricted to trusted storage or internal networks.

The directly supported impact is at least remote denial of service through kernel memory corruption and a possible crash. Because the underlying condition is a genuine double-free or use-after-free, confidentiality or integrity impact is possible in a paranoid worst-case assessment, although the patch does not demonstrate controlled memory corruption, information disclosure, privilege escalation, or remote code execution.