{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89526", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.719Z", "datePublished": "2026-09-11T19:44:07.043Z", "dateUpdated": "2026-09-11T19:44:07.043Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:44:07.043Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Validate Read chunk positions before reconstruction\n\nThe RPC/RDMA Read chunk position field is supplied by the remote\nclient and stored verbatim in the parsed chunk list.\nxdr_count_read_segments() checks only 4-byte alignment; it never\ncompares the position against the received inline body length.\n\nIn the single-chunk path, svc_rdma_read_complete_one() splits the\nhead and tail kvecs at ch_position. A position past the inline\nbody underflows the tail length, exposing adjacent slab memory to\nthe upper XDR decoder.\n\nIn the multi-chunk path, svc_rdma_read_multiple_chunks() computes\ngap lengths between chunks as unsigned subtractions from\nch_position. Overlapping Read chunks cause these subtractions to\nunderflow. A final position past the inline body likewise\nunderflows the trailing gap length. svc_rdma_copy_inline_range()\nthen copies past the receive buffer into request pages that are\nreturned to the client through the Reply channel.\n\nBound inline-range copies in svc_rdma_copy_inline_range() against\nthe decoded inline RPC body saved in rc_saved_arg. Reject a\nsingle Read chunk positioned beyond that body, and reject\nmulti-chunk lists where accumulated read bytes exceed the next\nchunk's position. Apply the same position and overlap checks in\nthe call-chunk interleaving path."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/xprtrdma/svc_rdma_rw.c"], "versions": [{"version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4", "lessThan": "5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2", "status": "affected", "versionType": "git"}, {"version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4", "lessThan": "f84ec84d8d4bc65f9ae23372570349687f66fa39", "status": "affected", "versionType": "git"}, {"version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4", "lessThan": "577097455d084610fc31e91e6a61c5793b6f04ba", "status": "affected", "versionType": "git"}, {"version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4", "lessThan": "3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/xprtrdma/svc_rdma_rw.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2"}, {"url": "https://git.kernel.org/stable/c/f84ec84d8d4bc65f9ae23372570349687f66fa39"}, {"url": "https://git.kernel.org/stable/c/577097455d084610fc31e91e6a61c5793b6f04ba"}, {"url": "https://git.kernel.org/stable/c/3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b"}], "title": "svcrdma: Validate Read chunk positions before reconstruction", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sunrpc/xprtrdma/svc_rdma_rw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2", "status": "affected", "version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4", "versionType": "git"}, {"lessThan": "f84ec84d8d4bc65f9ae23372570349687f66fa39", "status": "affected", "version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4", "versionType": "git"}, {"lessThan": "577097455d084610fc31e91e6a61c5793b6f04ba", "status": "affected", "version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4", "versionType": "git"}, {"lessThan": "3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b", "status": "affected", "version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sunrpc/xprtrdma/svc_rdma_rw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Validate Read chunk positions before reconstruction\n\nThe RPC/RDMA Read chunk position field is supplied by the remote\nclient and stored verbatim in the parsed chunk list.\nxdr_count_read_segments() checks only 4-byte alignment; it never\ncompares the position against the received inline body length.\n\nIn the single-chunk path, svc_rdma_read_complete_one() splits the\nhead and tail kvecs at ch_position. A position past the inline\nbody underflows the tail length, exposing adjacent slab memory to\nthe upper XDR decoder.\n\nIn the multi-chunk path, svc_rdma_read_multiple_chunks() computes\ngap lengths between chunks as unsigned subtractions from\nch_position. Overlapping Read chunks cause these subtractions to\nunderflow. A final position past the inline body likewise\nunderflows the trailing gap length. svc_rdma_copy_inline_range()\nthen copies past the receive buffer into request pages that are\nreturned to the client through the Reply channel.\n\nBound inline-range copies in svc_rdma_copy_inline_range() against\nthe decoded inline RPC body saved in rc_saved_arg. Reject a\nsingle Read chunk positioned beyond that body, and reject\nmulti-chunk lists where accumulated read bytes exceed the next\nchunk's position. Apply the same position and overlap checks in\nthe call-chunk interleaving path."}], "id": "CVE-2026-89526", "lastModified": "2026-09-11T20:19:35.383", "metrics": {}, "published": "2026-09-11T20:19:35.383", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/577097455d084610fc31e91e6a61c5793b6f04ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f84ec84d8d4bc65f9ae23372570349687f66fa39"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: svcrdma vulnerability allows remote information disclosure and memory corruption.", "id": "2532309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532309"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the `svcrdma` component of the Linux kernel. A remote attacker can exploit this vulnerability by supplying a crafted `RPC/RDMA Read chunk position` field that is not properly validated against the received inline body length. This can lead to an underflow, exposing adjacent slab memory or allowing data to be copied past the receive buffer into request pages. The most significant impact is information disclosure, potentially leading to memory corruption."], "name": "CVE-2026-89526", "public_date": "2026-09-11T19:44:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89526\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89526\nhttps://git.kernel.org/stable/c/3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b\nhttps://git.kernel.org/stable/c/577097455d084610fc31e91e6a61c5793b6f04ba\nhttps://git.kernel.org/stable/c/5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2\nhttps://git.kernel.org/stable/c/f84ec84d8d4bc65f9ae23372570349687f66fa39"], "threat_severity": "Important"}

{}