svcrdma: Reject oversized Read segments at decode time
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdr_count_read_segments() checks 4-byte alignment for non-zero position values but does not cap the segment length. An oversized rs_length reaches svc_rdma_build_read_segment(), which derives nr_bvec from it and can drive a large dynamic bvec allocation before verifying that enough rq_pages remain. If the post-allocation page-overrun guard fires, the freshly acquired rw context is not returned, leaking the resource. Reject any segment whose length exceeds the receive context's page budget during Read list decoding, consistent with how xdr_check_write_chunk() bounds Write segment counts against rc_maxpages. Also return the rw context on the existing post-allocation overrun path in svc_rdma_build_read_segment(), keeping that defensive guard balanced.
CVE-2026-89529
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-89529
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5ee62b4a91137557ee4b09d1604f1dfd0b4344a8",
"lessThan": "5120fe54e0e2f5b62797a432115cc61d61117a5b",
"versionType": "git"
},
{
"status": "affected",
"version": "5ee62b4a91137557ee4b09d1604f1dfd0b4344a8",
"lessThan": "af6f0e06bed818ee7fc8b869915964410020a1c5",
"versionType": "git"
}
],
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_recvfrom.c",
"net/sunrpc/xprtrdma/svc_rdma_rw.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_recvfrom.c",
"net/sunrpc/xprtrdma/svc_rdma_rw.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-89529
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #35052 · Revision 1
- Added to Heist Feed
- Publisher date