CVE-2026-89532

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Fix pcl_for_each_segment for empty chunks

When a parsed chunk list contains a chunk whose ch_segcount is zero,

pcl_for_each_segment computes its inclusive upper bound as

&chunk->ch_segments[ch_segcount - 1]. ch_segcount is u32, so the

subtraction wraps to 0xFFFFFFFF and the bound lands far past the

ch_segments flex array. The loop body then walks unrelated memory at

sizeof(struct svc_rdma_segment) stride until it faults.

A zero-segcount chunk is reachable from the wire:

xdr_check_write_chunk() only rejects segcount values greater than

rc_maxpages, and pcl_alloc_write() links a freshly allocated chunk

onto rc_write_pcl/rc_reply_pcl before its segment-fill loop runs,

so a Write or Reply chunk advertising zero segments leaves

ch_segcount == 0 on the list. When the transport has negotiated

Send-With-Invalidate, svc_rdma_get_inv_rkey() iterates all four

PCLs with pcl_for_each_segment and dereferences segment->rs

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References