CVE-2026-89529

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Reject oversized Read segments at decode time

The RPC/RDMA Read list decoder stores wire-supplied segment

lengths without validation. xdr_count_read_segments() checks

4-byte alignment for non-zero position values but does not

cap the segment length.

An oversized rs_length reaches svc_rdma_build_read_segment(),

which derives nr_bvec from it and can drive a large dynamic

bvec allocation before verifying that enough rq_pages remain.

If the post-allocation page-overrun guard fires, the freshly

acquired rw context is not returned, leaking the resource.

Reject any segment whose length exceeds the receive context's

page budget during Read list decoding, consistent with how

xdr_check_write_chunk() bounds Write segment counts against

rc_maxpages. Also return the rw context on the existing

post-allocation overrun path in svc_rdma_build_read_segment(),

keeping that defensive guard balanced.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References