CVE-2026-89526

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Validate Read chunk positions before reconstruction

The RPC/RDMA Read chunk position field is supplied by the remote

client and stored verbatim in the parsed chunk list.

xdr_count_read_segments() checks only 4-byte alignment; it never

compares the position against the received inline body length.

In the single-chunk path, svc_rdma_read_complete_one() splits the

head and tail kvecs at ch_position. A position past the inline

body underflows the tail length, exposing adjacent slab memory to

the upper XDR decoder.

In the multi-chunk path, svc_rdma_read_multiple_chunks() computes

gap lengths between chunks as unsigned subtractions from

ch_position. Overlapping Read chunks cause these subtractions to

underflow. A final position past the inline body likewise

underflows the trailing gap length. svc_rdma_copy_inline_range()

then copies past the receive buffer into request pages that are

returned to the client throu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References