Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-72217 EUVD-2026-58975GHSA-jffc-255g-3gq9

SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing

Published Aug 15, 2026 · Updated Aug 17, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-7.0 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-7.0 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.17 Package: linux-azure-fde-6.2 Package: linux-azure-fde-6.8 Package: linux-azure-fde-7.0 Package: linux-azure-fips Package: linux-azure-nvidia Package: linux-azure-nvidia-6.14 Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gcp-7.0 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-7.0 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-7.0 Package: linux-nvidia-bos Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oem-7.0 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-oracle-7.0 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-riscv-7.0 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing

xdr_buf_to_bvec() writes a bio_vec into the caller's array before
testing whether that slot is in range, and the head branch performs
the store with no check at all. When the caller's budget is exactly
used up, the next store lands one element past the end of the array.
The overflow label returns count - 1, which masks the surplus store
but cannot undo it.

rq_bvec, the array passed by nfsd_vfs_write(), is allocated to
exactly rq_maxpages entries with no slack. The OOB store can land in
adjacent slab memory; the bv_len and bv_offset fields written there
are derived from client-supplied RPC payload sizes.

Move the in-range check ahead of the store in the head, page-loop,
and tail branches. With the check at the top of each sequence, count
is incremented only after a successful store, so the overflow label
can return count directly.

Affected products

VendorProductAffectedFixed
Linux Linux 6.6 6.6.145

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 7.1.5-1 —
Debian 13 linux 6.12.100-1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 24.04 LTS linux-bluefield 6.8.0-1033.38 —
Ubuntu 26.04 LTS linux 7.0.0-34.34 USN-8816-1
Ubuntu 26.04 LTS linux-aws +1 7.0.0-1013.13 USN-8816-2, USN-8816-1
Ubuntu 26.04 LTS linux-azure 7.0.0-1017.17 USN-8888-1
Ubuntu 26.04 LTS linux-azure-fde 7.0.0-1016.16 USN-8888-1
Ubuntu 26.04 LTS linux-gke 7.0.0-1007.8 USN-8816-4
Ubuntu 26.04 LTS linux-ibm +1 7.0.0-1014.14 USN-8816-2, USN-8816-1
Ubuntu 26.04 LTS linux-nvidia 7.0.0-1025.26 USN-9043-1
Ubuntu 26.04 LTS linux-nvidia-bos 7.0.0-2022.23 USN-9003-1
Ubuntu 26.04 LTS linux-oracle 7.0.0-1012.12 USN-8816-1
Ubuntu 26.04 LTS linux-raspi 7.0.0-1020.20 USN-8816-1
Ubuntu 26.04 LTS linux-riscv +1 7.0.0-34.34.1 USN-8816-1
Ubuntu 24.04 LTS linux 6.8.0-147.147 USN-8917-1
Ubuntu 24.04 LTS linux-aws +1 6.8.0-1067.70 USN-9024-1, USN-8917-1
Ubuntu 24.04 LTS linux-aws-7.0 +1 7.0.0-1013.13~24.04.1 USN-8816-2, USN-8816-1
Ubuntu 24.04 LTS linux-azure-7.0 7.0.0-1017.17~24.04.1 USN-8888-2
Ubuntu 24.04 LTS linux-azure-fde 6.8.0-1069.76 USN-8918-1
Ubuntu 24.04 LTS linux-azure-fde-7.0 7.0.0-1016.16~24.04.1 USN-8888-2
Ubuntu 24.04 LTS linux-gcp +1 6.8.0-1071.79 USN-8918-1, USN-8917-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1066.74 USN-8917-1
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1052.56 USN-8917-1
Ubuntu 24.04 LTS linux-hwe-7.0 7.0.0-34.34~24.04.1 USN-8816-1
Ubuntu 24.04 LTS linux-ibm 6.8.0-1067.68 USN-8917-1
Ubuntu 24.04 LTS linux-lowlatency 6.8.0-147.147.1 USN-8917-1
Ubuntu 24.04 LTS linux-nvidia-7.0 7.0.0-1024.25~24.04.1 USN-9003-1
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1067.70.1 USN-9040-1
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1035.38 USN-8781-1
Ubuntu 24.04 LTS linux-oracle 6.8.0-1064.67 USN-8917-1
Ubuntu 24.04 LTS linux-oracle-7.0 7.0.0-1012.12~24.04.1 USN-8816-3
Ubuntu 24.04 LTS linux-raspi 6.8.0-1068.72 USN-9025-1
Ubuntu 24.04 LTS linux-riscv +29 No fix yet —
Ubuntu 24.04 LTS linux-riscv-7.0 7.0.0-34.34.1~24.04.1 —
Ubuntu 24.04 LTS linux-vmware 6.8.0-1008.8 —
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1069.74~22.04.1 USN-9024-1
Ubuntu 22.04 LTS linux-azure-6.8 6.8.0-1073.82~22.04.1 USN-9026-1
Ubuntu 22.04 LTS linux-azure-fde-6.8 6.8.0-1071.78~22.04.1 USN-9026-1
Ubuntu 22.04 LTS linux-gcp-6.8 6.8.0-1073.81~22.04.1 USN-9024-1
Ubuntu 22.04 LTS linux-hwe-6.8 6.8.0-149.149~22.04.1 USN-9066-1
Ubuntu 22.04 LTS linux-ibm-6.8 6.8.0-1069.70~22.04.1 USN-9024-1
Ubuntu 22.04 LTS linux-lowlatency-hwe-6.8 6.8.0-149.149.1~22.04.1 USN-9024-1
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1067.71~22.04.1 USN-9025-1
Ubuntu 22.04 LTS linux-riscv +33 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2056.58 USN-9025-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1062.63 USN-8917-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime-6.14 +1 No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-realtime-6.8 6.8.1-1064.65~22.04.1 USN-9024-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-aws-fips 6.8.0-1067.70+fips1 USN-8917-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips 6.8.0-147.147+fips1 USN-8917-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-gcp-fips +1 6.8.0-1071.79+fips1 USN-8918-1, USN-8917-1
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 kernel-64kb +8 6.12.0-160000.38.1 SUSE-SU-2026:23902-1
SLES for SAP 16.0 kernel-default-base 6.12.0-160000.38.1.160000.2.23 SUSE-SU-2026:23902-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_0 19-160000.4.3 SUSE-SU-2026:24173-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_1 17-160000.1.1 SUSE-SU-2026:24169-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_12 +1 6-160000.1.1 SUSE-SU-2026:24166-1, SUSE-SU-2026:24165-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_13 6-160000.1.2 SUSE-SU-2026:24167-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_15 4-160000.1.1 SUSE-SU-2026:24016-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_16 3-160000.1.1 SUSE-SU-2026:24162-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_2 15-160000.1.1 SUSE-SU-2026:24172-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_3 14-160000.1.1 SUSE-SU-2026:24171-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_4 13-160000.1.1 SUSE-SU-2026:24170-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_5 12-160000.1.1 SUSE-SU-2026:24174-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_6 11-160000.1.1 SUSE-SU-2026:24168-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_7 10-160000.1.1 SUSE-SU-2026:24163-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_8 9-160000.1.1 SUSE-SU-2026:24164-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_9 +2 8-160000.1.1 SUSE-SU-2026:24175-1, SUSE-SU-2026:24161-1, SUSE-SU-2026:24160-1
SLES 16.0 kernel-64kb +8 6.12.0-160000.38.1 SUSE-SU-2026:23902-1, SUSE-SU-2026:23897-1
SLES 16.0 kernel-default-base 6.12.0-160000.38.1.160000.2.23 SUSE-SU-2026:23902-1
SLES 16.0 kernel-livepatch-SLE16_Update_0 19-160000.4.3 SUSE-SU-2026:24173-1
SLES 16.0 kernel-livepatch-SLE16_Update_1 17-160000.1.1 SUSE-SU-2026:24169-1
SLES 16.0 kernel-livepatch-SLE16_Update_12 +1 6-160000.1.1 SUSE-SU-2026:24166-1, SUSE-SU-2026:24165-1
SLES 16.0 kernel-livepatch-SLE16_Update_13 6-160000.1.2 SUSE-SU-2026:24167-1
SLES 16.0 kernel-livepatch-SLE16_Update_15 4-160000.1.1 SUSE-SU-2026:24016-1
SLES 16.0 kernel-livepatch-SLE16_Update_16 3-160000.1.1 SUSE-SU-2026:24162-1
SLES 16.0 kernel-livepatch-SLE16_Update_2 15-160000.1.1 SUSE-SU-2026:24172-1
SLES 16.0 kernel-livepatch-SLE16_Update_3 14-160000.1.1 SUSE-SU-2026:24171-1
SLES 16.0 kernel-livepatch-SLE16_Update_4 13-160000.1.1 SUSE-SU-2026:24170-1
SLES 16.0 kernel-livepatch-SLE16_Update_5 12-160000.1.1 SUSE-SU-2026:24174-1
SLES 16.0 kernel-livepatch-SLE16_Update_6 11-160000.1.1 SUSE-SU-2026:24168-1
SLES 16.0 kernel-livepatch-SLE16_Update_7 10-160000.1.1 SUSE-SU-2026:24163-1
SLES 16.0 kernel-livepatch-SLE16_Update_8 9-160000.1.1 SUSE-SU-2026:24164-1
SLES 16.0 kernel-livepatch-SLE16_Update_9 +2 8-160000.1.1 SUSE-SU-2026:24175-1, SUSE-SU-2026:24161-1, SUSE-SU-2026:24160-1
SLE Micro 6.2 kernel-default-base 6.12.0-160000.38.1.160000.2.23 SUSE-SU-2026:23887-1
SLE Micro 6.2 kernel-livepatch-SLE16-RT_Update_0 17-160000.3.4 SUSE-SU-2026:24009-1
SLE Micro 6.2 kernel-livepatch-SLE16-RT_Update_1 16-160000.1.1 SUSE-SU-2026:24008-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_0 19-160000.4.3 SUSE-SU-2026:24106-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_1 17-160000.1.1 SUSE-SU-2026:24102-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_12 +4 6-160000.1.1 SUSE-SU-2026:24099-1, SUSE-SU-2026:24098-1, SUSE-SU-2026:23997-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_13 6-160000.1.2 SUSE-SU-2026:24100-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_15 +1 4-160000.1.1 SUSE-SU-2026:24010-1, SUSE-SU-2026:23994-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_16 +1 3-160000.1.1 SUSE-SU-2026:24094-1, SUSE-SU-2026:23993-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_2 15-160000.1.1 SUSE-SU-2026:24105-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_3 +1 14-160000.1.1 SUSE-SU-2026:24104-1, SUSE-SU-2026:24007-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_4 +2 13-160000.1.1 SUSE-SU-2026:24103-1, SUSE-SU-2026:24006-1, SUSE-SU-2026:24005-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_5 +1 12-160000.1.1 SUSE-SU-2026:24107-1, SUSE-SU-2026:24004-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_6 +1 11-160000.1.1 SUSE-SU-2026:24101-1, SUSE-SU-2026:24003-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_7 +1 10-160000.1.1 SUSE-SU-2026:24095-1, SUSE-SU-2026:24002-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_8 +1 9-160000.1.1 SUSE-SU-2026:24097-1, SUSE-SU-2026:24001-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_9 +5 8-160000.1.1 SUSE-SU-2026:24108-1, SUSE-SU-2026:24093-1, SUSE-SU-2026:24092-1
SLE Micro 6.2 kernel-rt +5 6.12.0-160000.38.1 SUSE-SU-2026:23887-1, SUSE-SU-2026:23881-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 kernel-default-base 6.12.0-160000.38.1.160000.2.22 openSUSE-SU-2026:21910-1
openSUSE Leap 16.0 kernel-rt +11 6.12.0-160000.38.1 openSUSE-SU-2026:21910-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 kernel-livepatch-6.18.41-94.142 +1 1:1.0-0.amzn2023 ALAS2023-2026-2071, ALAS2023-2026-2057
Amazon Linux 2023 perf6.12 +11 1:6.12.100-125.179.amzn2023 ALAS2023-2026-2057
Amazon Linux 2023 perf6.18 +12 1:6.18.41-94.142.amzn2023 ALAS2023-2026-2071

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 kernel-uek +34 6.12.0-206.104.3.3.el10uek ELSA-2026-500248

Advisories 50

References