nvmet-rdma: handle inline data with a nonzero offset
In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).
CVE-2026-72129
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-72129
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
"lessThan": "c2106ba1b14d644a5203bea1a50dbe25dcad713c",
"versionType": "git"
},
{
"status": "affected",
"version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
"lessThan": "bf8bcc1c137d54a62a428b00051fdbb13660673b",
"versionType": "git"
},
{
"status": "affected",
"version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
"lessThan": "11401371152b228448a41d79c6de1c938f93049a",
"versionType": "git"
},
{
"status": "affected",
"version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
"lessThan": "7c96581169c9d9a7d0726e554313acfbead6141c",
"versionType": "git"
},
{
"status": "affected",
"version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
"lessThan": "42a8ea3acd883f4f210d9e54e0975b1e2292b529",
"versionType": "git"
},
{
"status": "affected",
"version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
"lessThan": "2944113ad5fbcdf5d349d857c03d2a44b6de75b8",
"versionType": "git"
},
{
"status": "affected",
"version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
"lessThan": "98bcdfa619150b2f41fa15bac140dbaf2584ad05",
"versionType": "git"
},
{
"status": "affected",
"version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
"lessThan": "48c0162f647bb47e6084ffbc71b8f213f5e2f4f8",
"versionType": "git"
}
],
"programFiles": [
"drivers/nvme/target/rdma.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.19",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/nvme/target/rdma.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-72129
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #32956 · Revision 1
- Added to Heist Feed
- Publisher date