CVE-2026-89530svcrdma: Reject inline replies that overflow the pull-up buffer
- 9.8CriticalCVSS base score
- 0.49%Exploitation in 30 daysEPSS · top 57% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more scatter/gather entries than the device's Send Queue supports, svc_rdma_pull_up_needed() selects pull-up and svc_rdma_pull_up_reply_msg() linearizes the whole reply into sctxt->sc_xprt_buf. That buffer is only sc_max_req_size bytes, while the reply on this path is bounded only by the client's request, so svc_rdma_xb_linearize() copies past the end of the buffer and corrupts adjacent slab memory. The oversized length is then stored in sc_sges[0].length and posted, so the device also reads beyond the mapped region. The SGE-exhaustion branch is the only pull-up path that can exceed the buffer: the threshold branch pulls up only replies smaller than RPCRDMA_PULLUP_THRESH, and replies that fit the device's SGE budget are sent directly without linearization. Make svc_rdma_pull_up_needed() report -E2BIG when the reply it would pull up cannot fit sc_max_req_size, and fail the request with ERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping the connection. The helper no longer answers a simple yes/no question: it now reports pull-up, no pull-up, or -E2BIG for a reply too large to linearize. Rename svc_rdma_pull_up_needed() to svc_rdma_check_pull_up() so its name no longer implies a boolean predicate.
Timeline
ID reserved
By Linux
Published
- 49 days later
· 49 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.49% · top 57% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected e248aa7be86e8179f20ac0931774ecd746f3f5bf – < b73011049dbe909f73fd9620d94ef1757d7af2eb
- affected e248aa7be86e8179f20ac0931774ecd746f3f5bf – < 8068358f445a11296328ffa7c524701596814a17
- affected e248aa7be86e8179f20ac0931774ecd746f3f5bf – < fcd91b9957462d398792201c239dffaeff1cc8b2
- affected e248aa7be86e8179f20ac0931774ecd746f3f5bf – < 1949dd1576f7a8aa161b1330c6125df9d53046d5
- affected e248aa7be86e8179f20ac0931774ecd746f3f5bf – < 8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf
- affected e248aa7be86e8179f20ac0931774ecd746f3f5bf – < 0fbe20dfe74b783d255bf389a6ea77aa25dc7860
- affected 9b65b18f817d9ada2bf67351f24bdcce6789a0bb
- affected d564356e1919d1178568c19af410cfc1a9076663
- affected 4.19.22 – < 4.20
- affected 4.20.9 – < 4.21
- affected 5.0
- unaffected < 5.0
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.109 – ≤ 6.12.*
- unaffected 6.18.50 – ≤ 6.18.*
- unaffected 7.2.4 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/b73011049dbe909f73fd9620d94ef1757d7af2eb (opens in a new tab)
- https://git.kernel.org/stable/c/8068358f445a11296328ffa7c524701596814a17 (opens in a new tab)
- https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2 (opens in a new tab)
- https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5 (opens in a new tab)
- https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf (opens in a new tab)
- https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-76436 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89530)Record last updated .