CVE-2026-89533

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Fix offset arithmetic in read_chunk_range

svc_rdma_read_chunk_range() walks a Read chunk's segment list to

build a sub-range starting at byte offset and spanning length bytes

for a Position-Zero or Call chunk. Two arithmetic defects in the

per-segment loop produce wrong DMA lengths and a u32 underflow:

pcl_for_each_segment(segment, chunk) {

if (offset > segment->rs_length) {

offset -= segment->rs_length;

continue;

}

dummy.rs_handle = segment->rs_handle;

dummy.rs_length = min_t(u32, length,

segment->rs_length) - offset;

dummy.rs_offset = segment->rs_offset + offset;

First, the skip predicate uses '>' instead of '>='. When offset

equals the segment's full rs_length, the segment is fully consumed

and should be skipped, but the loop falls through into the body.

The result

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References