- 9.8CriticalCVSS base score
- 0.71%Exploitation in 30 daysEPSS · top 46% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.71% · top 46% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 – < c2106ba1b14d644a5203bea1a50dbe25dcad713c
- affected 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 – < bf8bcc1c137d54a62a428b00051fdbb13660673b
- affected 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 – < 11401371152b228448a41d79c6de1c938f93049a
- affected 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 – < 7c96581169c9d9a7d0726e554313acfbead6141c
- affected 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 – < 42a8ea3acd883f4f210d9e54e0975b1e2292b529
- affected 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 – < 2944113ad5fbcdf5d349d857c03d2a44b6de75b8
- affected 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 – < 98bcdfa619150b2f41fa15bac140dbaf2584ad05
- affected 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 – < 48c0162f647bb47e6084ffbc71b8f213f5e2f4f8
- affected 4.19
- unaffected < 4.19
- unaffected 5.10.261 – ≤ 5.10.*
- unaffected 5.15.212 – ≤ 5.15.*
- unaffected 6.1.178 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.97 – ≤ 6.12.*
- unaffected 6.18.40 – ≤ 6.18.*
- unaffected 7.1.5 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/c2106ba1b14d644a5203bea1a50dbe25dcad713c (opens in a new tab)
- https://git.kernel.org/stable/c/bf8bcc1c137d54a62a428b00051fdbb13660673b (opens in a new tab)
- https://git.kernel.org/stable/c/11401371152b228448a41d79c6de1c938f93049a (opens in a new tab)
- https://git.kernel.org/stable/c/7c96581169c9d9a7d0726e554313acfbead6141c (opens in a new tab)
- https://git.kernel.org/stable/c/42a8ea3acd883f4f210d9e54e0975b1e2292b529 (opens in a new tab)
- https://git.kernel.org/stable/c/2944113ad5fbcdf5d349d857c03d2a44b6de75b8 (opens in a new tab)
- https://git.kernel.org/stable/c/98bcdfa619150b2f41fa15bac140dbaf2584ad05 (opens in a new tab)
- https://git.kernel.org/stable/c/48c0162f647bb47e6084ffbc71b8f213f5e2f4f8 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-58887 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-72129)Record last updated .