{"id":"CVE-2026-72150","summary":"sunrpc: fix uninitialized xprt_create_args structure","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix uninitialized xprt_create_args structure\n\nThe xprt_create_args structure is allocated on the stack without\ninitialization in rpc_sysfs_xprt_switch_add_xprt_store(). While some\nfields are manually populated, critical fields like srcaddr, bc_xps,\nand flags contain uninitialized stack garbage.\n\nThis can lead to:\n1. Kernel panic when xs_setup_xprt() dereferences garbage srcaddr\n2. Information leak if srcaddr points to sensitive stack data\n3. Unpredictable behavior if flags has random bits set\n\nThe fix is to zero-initialize the structure to ensure all unused\nfields are NULL/0, preventing the transport setup code from acting\non garbage data.","modified":"2026-08-20T03:30:12.432040978Z","published":"2026-08-15T05:53:21.440Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72150.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/17d90b68c3a3d7d7e95b49e1fe9381a723f637a8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7d3ce3bd23c062a7c1c6d372d1b08e48b9e17cc3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/933654508b2bc36e2c3c086c0365e2403fb2141f"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72150.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72150"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"df210d9b0951d714c1668c511ca5c8ff38cf6916"},{"fixed":"933654508b2bc36e2c3c086c0365e2403fb2141f"},{"fixed":"7d3ce3bd23c062a7c1c6d372d1b08e48b9e17cc3"},{"fixed":"17d90b68c3a3d7d7e95b49e1fe9381a723f637a8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72150.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.15.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72150.json"}}],"schema_version":"1.9.0"}