{"apiVersion":"1.0","identifier":"CVE-2026-72217","description":"In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing xdr_buf_to_bvec() writes a bio_vec into the caller-s array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the caller-s budget is exactly used up, the next store lands one element past the end of the array. The overflow label returns count - 1, which masks the surplus store but cannot undo it. rq_bvec, the array passed by nfsd_vfs_write(), is allocated to exactly rq_maxpages entries with no slack. The OOB store can land in adjacent slab memory; the bv_len and bv_offset fields written there are derived from client-supplied RPC payload sizes. Move the in-range check ahead of the store in the head, page-loop, and tail branches. With the check at the top of each sequence, count is incremented only after a successful store, so the overflow label can return count directly.","publishedAt":"2026-08-15T06:21:40","lastModifiedAt":"2026-08-17T06:18:22","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72217","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00618,"riskScore":1.03,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72217","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72217","en":"https://www.redsauce.net/en/cves/CVE-2026-72217","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72217","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72217","de":"https://www.redsauce.net/de/cves/CVE-2026-72217","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72217","el":"https://www.redsauce.net/el/cves/CVE-2026-72217"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72217"}}