CVE-2026-72468

In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: Initialize re_id before removal registration

rpcrdmacreateid() registers ep->rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate(). However rpcrdmaepcreate() currently stores that pointer in ep->reid only after rpcrdmacreate_id() returns.

A local administrator can race an NFS/RDMA mount against RDMA device removal. If rpcrdmaremoveone() observes the just-registered notification before rpcrdmaepcreate() assigns ep->reid, rpcrdmaepremovaldone() calls tracexprtrdmadeviceremoval(NULL). The tracepoint dereferences id->device->name and copies id->route.addr.dstaddr, so the callback can crash the kernel with a NULL pointer dereference.

Store the rdmacmid in ep->reid immediately before publishing ep->rern. The existing error path still destroys the id directly if registration fails; ep is then freed by the caller without using ep->reid. Remove the later duplicate assignment in rpcrdmaep_create().