Description
A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire multi-page reply into a fixed-size 4096-byte heap buffer without bounds checking, resulting in a kernel heap overflow. This can lead to denial of service via kernel crash or potential code execution through corruption of adjacent kernel heap objects.
Published: 2026-09-22
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Denial of Service via kernel crash with potential code execution
Action: Disable Svcrdma
AI Analysis

Impact

A heap out‑of‑bounds write exists in the Linux kernel’s RPC‑over‑RDMA server reply path. A crafted NFS READ request from a client—with an empty write list and no reply chunk—forces the server to linearize a multi‑page reply into a fixed 4 KB heap buffer without bounds checking, causing a heap overflow. The overflow can crash the kernel or corrupt adjacent kernel objects, allowing privilege escalation or denial of service.

Affected Systems

Affected are Red Hat Enterprise Linux families: versions 6, 7, 8, 9 and the Enterprise Linux for NVIDIA 26 distribution. The flaw resides in the kernel module handling NFS over RDMA and requires the kernel to be compiled with CONFIG_SUNRPC_XPRT_RDMA enabled and RDMA hardware such as InfiniBand or RoCE present. Systems lacking RDMA hardware or NFS‑over‑RDMA export are not affected.

Risk and Exploitability

The CVSS score of 8.8 classifies the vulnerability as high. EPSS is not available and the flaw is not listed in CISA’s KEV catalog. Exploitation requires an RDMA‑enabled NFS server and a client able to send the specific malformed RPC request. An attacker can trigger a kernel crash or corrupt heap objects to potentially achieve code execution on the host. Disaster will occur if the vulnerable kernel is accessible to untrusted clients over the network.

Generated by OpenCVE AI on September 22, 2026 at 18:43 UTC.

Remediation

Vendor Workaround

This vulnerability requires the NFS/RDMA server to be running with CONFIG_SUNRPC_XPRT_RDMA enabled, which requires RDMA hardware (InfiniBand or RoCE). Systems that do not have RDMA hardware or do not export NFS over RDMA are not affected. If NFS/RDMA is not required, disabling or not loading the svcrdma kernel module prevents exploitation.

OpenCVE Recommended Actions

  • Unload or disable the svcrdma kernel module if NFS‑over‑RDMA is not required
  • Apply the latest Red Hat kernel security updates that contain a fix for this issue
  • Ensure RDMA hardware is not exposed to untrusted networks and restrict NFS‑over‑RDMA traffic to trusted hosts

Generated by OpenCVE AI on September 22, 2026 at 18:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux For Nvidia 26
Vendors & Products Redhat enterprise Linux For Nvidia 26

Tue, 22 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 17:00:00 +0000

Type Values Removed Values Added
Description A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire multi-page reply into a fixed-size 4096-byte heap buffer without bounds checking, resulting in a kernel heap overflow. This can lead to denial of service via kernel crash or potential code execution through corruption of adjacent kernel heap objects.
Title Kernel: heap out-of-bounds write in the linux kernel rpc-over-rdma server reply path...
First Time appeared Redhat
Redhat enterprise Linux
Redhat enterprise Linux Nvidia
Weaknesses CWE-787
CPEs cpe:/a:redhat:enterprise_linux_nvidia:
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat enterprise Linux Nvidia
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Redhat Enterprise Linux Enterprise Linux For Nvidia 26 Enterprise Linux Nvidia
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-22T17:58:28.314Z

Reserved: 2026-06-23T18:49:07.981Z

Link: CVE-2026-13087

cve-icon Vulnrichment

Updated: 2026-09-22T17:57:27.668Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-22T17:17:23.807

Modified: 2026-09-22T19:37:36.747

Link: CVE-2026-13087

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T19:13:33Z

Weaknesses