CVE-2026-93228

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Reject Write/Reply chunks with segcount 0

A peer can send a Write or Reply chunk whose segcount field is zero.

xdr_check_write_chunk() only rejects segcount > rc_maxpages, so zero

passes the range check, and xdr_inline_decode(stream, 0) returns the

current (non-NULL) cursor without advancing. The function returns

true and pcl_alloc_write() then links a struct svc_rdma_chunk with

ch_segcount == 0 onto rc_write_pcl or rc_reply_pcl.

An earlier patch in this series made pcl_for_each_segment() safe for

ch_segcount == 0, so this no longer drives the memory walk it used

to. Rejecting the malformed frame at the decode boundary is still

worthwhile as defense in depth: it keeps degenerate zero-segment

chunks off the parsed chunk lists entirely, so any future consumer

that walks ch_segments directly cannot observe one, and it makes the

zero-floor easy to backport to trees where the macro change is more

intrusive. RFC

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References