CVE-2026-89526svcrdma: Validate Read chunk positions before reconstruction
- 9.8CriticalCVSS base score
- 0.68%Exploitation in 30 daysEPSS · top 47% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdr_count_read_segments() checks only 4-byte alignment; it never compares the position against the received inline body length. In the single-chunk path, svc_rdma_read_complete_one() splits the head and tail kvecs at ch_position. A position past the inline body underflows the tail length, exposing adjacent slab memory to the upper XDR decoder. In the multi-chunk path, svc_rdma_read_multiple_chunks() computes gap lengths between chunks as unsigned subtractions from ch_position. Overlapping Read chunks cause these subtractions to underflow. A final position past the inline body likewise underflows the trailing gap length. svc_rdma_copy_inline_range() then copies past the receive buffer into request pages that are returned to the client through the Reply channel. Bound inline-range copies in svc_rdma_copy_inline_range() against the decoded inline RPC body saved in rc_saved_arg. Reject a single Read chunk positioned beyond that body, and reject multi-chunk lists where accumulated read bytes exceed the next chunk's position. Apply the same position and overlap checks in the call-chunk interleaving path.
Timeline
ID reserved
By Linux
Published
- 49 days later
· 49 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.68% · top 47% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected d96962e6d0e281bab6a48e83b42f5dce6eb28bf4 – < 6388f2ed36c10f59d926735b92c2b152d2c635e5
- affected d96962e6d0e281bab6a48e83b42f5dce6eb28bf4 – < 3861eeabaebe243050952b34063763527c44e1fe
- affected d96962e6d0e281bab6a48e83b42f5dce6eb28bf4 – < 5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2
- affected d96962e6d0e281bab6a48e83b42f5dce6eb28bf4 – < f84ec84d8d4bc65f9ae23372570349687f66fa39
- affected d96962e6d0e281bab6a48e83b42f5dce6eb28bf4 – < 577097455d084610fc31e91e6a61c5793b6f04ba
- affected d96962e6d0e281bab6a48e83b42f5dce6eb28bf4 – < 3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b
- affected 5.11
- unaffected < 5.11
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.109 – ≤ 6.12.*
- unaffected 6.18.50 – ≤ 6.18.*
- unaffected 7.2.4 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/6388f2ed36c10f59d926735b92c2b152d2c635e5 (opens in a new tab)
- https://git.kernel.org/stable/c/3861eeabaebe243050952b34063763527c44e1fe (opens in a new tab)
- https://git.kernel.org/stable/c/5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2 (opens in a new tab)
- https://git.kernel.org/stable/c/f84ec84d8d4bc65f9ae23372570349687f66fa39 (opens in a new tab)
- https://git.kernel.org/stable/c/577097455d084610fc31e91e6a61c5793b6f04ba (opens in a new tab)
- https://git.kernel.org/stable/c/3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-76432 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89526)Record last updated .