NFSundown

概述 NFSundown（CVE-2025-38089）的概念验证利用代码。它可以远程触发NFS服务器的内核崩溃。 详情 远程攻击者可通过发送特制的RPC请求，触发内核空指针解引用并导致内核崩溃。这是由于在SUNRPC代码路径中未正确处理 rqstp-rqacceptstatp 指针，使其保持为NULL并在错误处理分支中被解引用。在某些情况下（当所有服务器线程至少接受过一次连接时），这还可能导致释放后使用（use-after-free）。该漏洞已被分配编号CVE-2025-38089。 受影响版本...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Trap RDMA segment overflows This fix prevents svcrdmabuildwrites from exceeding the end of a Write chunk’s segment array. This issue was identified using KASAN. The test that this fix replaces is invalid; it may have...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcpwritetimerhandler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fixed the svcdeferredevent trace class. Fixed a NULL dereference crash that occurs when an svcrqst is deferred, while the sunrpc tracing subsystem is enabled. svcrevisit sets dr-xprt to NULL, so it cannot be relied upon i...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: SUNRPC: Fixed a suspicious RCU usage warning I received the following warning while running cthon on an Ontap server running pNFS: 57.202521 ============================= 57.202522 WARNING: Suspicious RCU usage 57.202523...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fixed the loop termination condition in gssfreeintokenpages. The intoken-pages array is not NULL-terminated. This results in the following KASAN issue: KASAN: Potential wild-memory-access in the range...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: SUNRPC: Fixed null-ptr-deref when xps sysfs alloc fails There is a null-ptr-deref when xps sysfs alloc fails: BUG: KASAN: null-ptr-deref in sysfsdocreatelinksd+0x40/0xd0 Reading a 8-byte value at address 0000000000000030 by ta...

Astra Linux – Vulnerability in glibc

The deprecated compatibility function clntcreate in the sunrpc module of the GNU C Library also known as glibc from versions up to 2.34 copies its hostname argument onto the stack without validating its length. This may lead to a buffer overflow, potentially causing a denial of service or, if the...

CVE-2026-72317

A flaw was found in the Linux kernel's SUN Remote Procedure Call SUNRPC implementation. A use-after-free vulnerability exists in the Transport Layer Security TLS connection path. When a TLS handshake fails, the client resource can be prematurely freed, leading to a subsequent attempt to access th...

CVE-2026-72222

A flaw was found in the Linux kernel's sunrpc component, which affects TLS-enabled Network File System NFS servers. A race condition exists during the asynchronous TLS handshake process. A remote attacker could exploit this by closing a connection at a specific time, leading to memory corruption...

CVE-2026-72221

A flaw was found in the kernel. A race condition exists in the sunrpc component during the Transport Layer Security TLS handshake cancellation process. This can lead to the corruption of an internal data structure, potentially causing system instability or a denial of service. Additionally, it ma...

CVE-2026-72217

A flaw was found in the Linux kernel's SUNRPC component. The xdrbuftobvec function performs an out-of-bounds write when processing client-supplied RPC Remote Procedure Call payload sizes without proper boundary checks. A remote attacker could exploit this by crafting malicious RPC requests, leadi...

CVE-2026-72150

A flaw was found in the Linux kernel's sunrpc component. The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. This can lead to critical fields containing uninitialized stack garbage. Exploiting this vulnerability can result in a kernel...

Linux Distros Unpatched Vulnerability : CVE-2026-72217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and th...

Linux Distros Unpatched Vulnerability : CVE-2026-72220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sunrpc: harden rqprocinfo lifecycle to prevent double-free The svcreleaserqst function executes the callback inside rqstp-rqprocinfo-pcrelease. However, if a...

Linux Distros Unpatched Vulnerability : CVE-2026-72317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworke...

Linux Distros Unpatched Vulnerability : CVE-2026-72222

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the...

Linux Distros Unpatched Vulnerability : CVE-2026-72221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or...

CVE-2026-72220

A flaw was found in the Linux kernel's sunrpc component. When a worker thread processes a new request and encounters an early error, a stale release hook can be re-triggered against previously used data. This can lead to a double-free or use-after-free vulnerability, potentially allowing an...

CVE-2026-72317

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworker. xsconnect stores task-tkclient in sockxprt::clnt as a raw pointer...