CVE-2026-89526 - Vulnerability Details

- svcrdma: Validate Read chunk positions before reconstruction

Description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Validate Read chunk positions before reconstruction

The RPC/RDMA Read chunk position field is supplied by the remote
client and stored verbatim in the parsed chunk list.
xdr_count_read_segments() checks only 4-byte alignment; it never
compares the position against the received inline body length.

In the single-chunk path, svc_rdma_read_complete_one() splits the
head and tail kvecs at ch_position. A position past the inline
body underflows the tail length, exposing adjacent slab memory to
the upper XDR decoder.

In the multi-chunk path, svc_rdma_read_multiple_chunks() computes
gap lengths between chunks as unsigned subtractions from
ch_position. Overlapping Read chunks cause these subtractions to
underflow. A final position past the inline body likewise
underflows the trailing gap length. svc_rdma_copy_inline_range()
then copies past the receive buffer into request pages that are
returned to the client through the Reply channel.

Bound inline-range copies in svc_rdma_copy_inline_range() against
the decoded inline RPC body saved in rc_saved_arg. Reject a
single Read chunk positioned beyond that body, and reject
multi-chunk lists where accumulated read bytes exceed the next
chunk's position. Apply the same position and overlap checks in
the call-chunk interleaving path.

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the Linux kernel's RDMA read handling, where the RPC/RDMA Read chunk position supplied by a remote client is stored without proper bounds checking. This oversight allows the reference memory beyond the intended inline body. The resulting out-of-bounds read can expose adjacent slab memory, providing an attacker with kernel data that may contain sensitive information or enable further exploitation.

Affected Systems

All installations of the Linux kernel that of distribution or specific kernel version, until the official patch that validates read positions is applied. The vulnerability is present in both single- and multi-chunk RDMA read paths.

Risk and Exploitability

The CVSS score of 8.1 classifies this as a high severity flaw. The EPSS score of less than 1% indicates a very low probability of exploitation, though it is non‑zero, and the vulnerability is not listed in the CISA KEV catalog. Attackers could exploit it over the network by sending crafted RDMA read requests, assuming RDMA services are reachable. No user interaction is required, and the exploit would rely purely on network traffic or an embedded client. Prompt remediation is therefore critical.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d96962e6d0e281bab6a48e83b42f5dce6eb28bf4`	affected	< 5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2
`d96962e6d0e281bab6a48e83b42f5dce6eb28bf4`	affected	< f84ec84d8d4bc65f9ae23372570349687f66fa39
`d96962e6d0e281bab6a48e83b42f5dce6eb28bf4`	affected	< 577097455d084610fc31e91e6a61c5793b6f04ba
`d96962e6d0e281bab6a48e83b42f5dce6eb28bf4`	affected	< 3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b

Linux

affected

Version	Status	Constraints
`5.11`	affected	—
`0`	unaffected	< 5.11
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d96962e6d0e281bab6a48e83b42f5dce6eb28bf4,5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2)`	affected	code_commit	—
`[d96962e6d0e281bab6a48e83b42f5dce6eb28bf4,f84ec84d8d4bc65f9ae23372570349687f66fa39)`	affected	code_commit	—
`[d96962e6d0e281bab6a48e83b42f5dce6eb28bf4,577097455d084610fc31e91e6a61c5793b6f04ba)`	affected	code_commit	—
`[d96962e6d0e281bab6a48e83b42f5dce6eb28bf4,3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.11`	affected	generic	—
`[0,5.11)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest kernel patch that validates RDMA read chunk positions before reconstruction, as referenced in the CVE documentation.
If the patch cannot be applied immediately, disable RDMA or restrict it to a trusted network boundary using firewall rules or network segmentation.
Check the kernel configuration to ensure RDMA is not compiled in or loaded as a module when not required, and remove any unintended RDMA services.
Monitor kernel logs for anomalous out-of-bounds read warnings and verify that no unexpected memory exposures occur.

Generated by OpenCVE AI on September 13, 2026 at 04:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b
https://git.kernel.org/stable/c/577097455d084610fc31e91e6a61c5793b6f04ba
https://git.kernel.org/stable/c/5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2
https://git.kernel.org/stable/c/f84ec84d8d4bc65f9ae23372570349687f66fa39
https://nvd.nist.gov/vuln/detail/CVE-2026-89526
https://www.cve.org/CVERecord?id=CVE-2026-89526

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89526 https://www.cve.org/CVERecord?id=CVE-2026-89526
Metrics	threat_severity `None`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdr_count_read_segments() checks only 4-byte alignment; it never compares the position against the received inline body length. In the single-chunk path, svc_rdma_read_complete_one() splits the head and tail kvecs at ch_position. A position past the inline body underflows the tail length, exposing adjacent slab memory to the upper XDR decoder. In the multi-chunk path, svc_rdma_read_multiple_chunks() computes gap lengths between chunks as unsigned subtractions from ch_position. Overlapping Read chunks cause these subtractions to underflow. A final position past the inline body likewise underflows the trailing gap length. svc_rdma_copy_inline_range() then copies past the receive buffer into request pages that are returned to the client through the Reply channel. Bound inline-range copies in svc_rdma_copy_inline_range() against the decoded inline RPC body saved in rc_saved_arg. Reject a single Read chunk positioned beyond that body, and reject multi-chunk lists where accumulated read bytes exceed the next chunk's position. Apply the same position and overlap checks in the call-chunk interleaving path.
Title		svcrdma: Validate Read chunk positions before reconstruction
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b https://git.kernel.org/stable/c/577097455d084610fc31e91e6a61c5793b6f04ba https://git.kernel.org/stable/c/5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2 https://git.kernel.org/stable/c/f84ec84d8d4bc65f9ae23372570349687f66fa39

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:07.043Z

Updated: 2026-09-13T06:30:24.722Z

Reserved: 2026-09-11T19:38:34.719Z

Link: CVE-2026-89526

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:35.383

Modified: 2026-09-13T07:17:14.973

Link: CVE-2026-89526

Redhat

Severity : Important

Publid Date: 2026-09-11T19:44:07Z

Links: CVE-2026-89526 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T04:15:13Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object