In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re_id before removal registration rpcrdma_create_id() registers ep->re_rn with the rpcrdma ib_client before returning the new rdma_cm_id to rpcrdma_ep_create(). However rpcrdma_ep_create() currently stores that pointer in ep->re_id only after rpcrdma_create_id() returns. A local administrator can race an NFS/RDMA mount against RDMA device removal. If rpcrdma_remove_one() observes the just-registered notification before rpcrdma_ep_create() assigns ep->re_id, rpcrdma_ep_removal_done() calls trace_xprtrdma_device_removal(NULL). The tracepoint dereferences id->device->name and copies id->route.addr.dst_addr, so the callback can crash the kernel with a NULL pointer dereference. Store the rdma_cm_id in ep->re_id immediately before publishing ep->re_rn. The existing error path still destroys the id directly if registration fails; ep is then freed by the caller without using ep->re_id. Remove the later duplicate assignment in rpcrdma_ep_create().

ubuntu_linux USN-8888-1: Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re_id before
    removal registration rpcrdma_create_id() registers ep->re_rn with the rpcrdma ib_client before returning
    the new rdma_cm_id to rpcrdma_ep_create(). However rpcrdma_ep_create() currently stores that pointer in
    ep->re_id only after rpcrdma_create_id() returns. A local administrator can race an NFS/RDMA mount against
    RDMA device removal. If rpcrdma_remove_one() observes the just-registered notification before
    rpcrdma_ep_create() assigns ep->re_id, rpcrdma_ep_removal_done() calls
    trace_xprtrdma_device_removal(NULL). The tracepoint dereferences id->device->name and copies
    id->route.addr.dst_addr, so the callback can crash the kernel with a NULL pointer dereference. Store the
    rdma_cm_id in ep->re_id immediately before publishing ep->re_rn. The existing error path still destroys
    the id directly if registration fails; ep is then freed by the caller without using ep->re_id. Remove the
    later duplicate assignment in rpcrdma_ep_create(). (CVE-2026-72468)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re_id before     removal registration rpcrdma_create_id() registers ep->re_rn with the rpcrdma ib_client before returning     the new rdma_cm_id to rpcrdma_ep_create(). However rpcrdma_ep_create() currently stores that pointer in     ep->re_id only after rpcrdma_create_id() returns. A local administrator can race an NFS/RDMA mount against     RDMA device removal. If rpcrdma_remove_one() observes the just-registered notification before     rpcrdma_ep_create() assigns ep->re_id, rpcrdma_ep_removal_done() calls     trace_xprtrdma_device_removal(NULL). The tracepoint dereferences id->device->name and copies     id->route.addr.dst_addr, so the callback can crash the kernel with a NULL pointer dereference. Store the     rdma_cm_id in ep->re_id immediately before publishing ep->re_rn. The existing error path still destroys     the id directly if registration fails; ep is then freed by the caller without using ep->re_id. Remove the     later duplicate assignment in rpcrdma_ep_create(). (CVE-2026-72468)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Type	Severity
471110	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Cloud Security	Google COS Security Checks	Local	medium
471110	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
469395	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.448.8	Tenable Cloud Security	Google COS Security Checks	Local	medium
469395	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.448.8	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
468705	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19216.655.6	Tenable Cloud Security	Google COS Security Checks	Local	medium
468705	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19216.655.6	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
350138	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21910-1)	Nessus	SuSE Local Security Checks	Local	high
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
337855	Linux Distros Unpatched Vulnerability : CVE-2026-72468	Nessus	Misc.	Local	medium
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-72468

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

high

high

medium

high