CVE-2026-89526
moderateMissing Read chunk position validation in Linux svcrdma leaks kernel memory
The Linux kernel's svcrdma server transport (used to serve NFS over RDMA) fails to validate the RPC/RDMA Read chunk position field supplied by the remote client, which is stored verbatim in the parsed chunk list. A malicious RDMA client can send a Read chunk positioned beyond the received inline RPC body, or overlapping Read chunks, causing unsigned length underflows that make svc_rdma_copy_inline_range() copy past the receive buffer into request pages that are returned to the client in the Reply. This exposes adjacent kernel slab memory to the attacker, an unauthenticated remote information disclosure rated CVSS 9.8. Only systems running the NFS daemon with the RPC-over-RDMA (InfiniBand/RoCE) transport enabled are affected, and attackers need network access to that RDMA transport, which is typically confined to HPC and storage-fabric networks. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.
What to do: Update to a kernel release containing the upstream fix (commit 'svcrdma: Validate Read chunk positions before reconstruction') from your distribution's stable kernel packages. If you cannot patch immediately, disable NFSD over RDMA (do not load/enable the svcrdma server transport and serve NFS over TCP only) or restrict access to the RDMA fabric and port 20049 to trusted clients. Check whether RDMA-enabled NFS serving is even in use before prioritizing, since the flaw is unreachable on standard TCP-based NFS deployments.
| Linux kernel (svcrdma / NFSD RPC-over-RDMA server transport) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdr_count_read_segments() checks only 4-byte alignment; it never compares the position against the received inline body length. In the single-chunk path, svc_rdma_read_complete_one() splits the head and tail kvecs at ch_position. A position past the inline body underflows the tail length, exposing adjacent slab memory to the upper XDR decoder. In the multi-chunk path, svc_rdma_read_multiple_chunks() computes gap lengths between chunks as unsigned subtractions from ch_position. Overlapping Read chunks cause these subtractions to underflow. A final position past the inline body likewise underflows the trailing gap length. svc_rdma_copy_inline_range() then copies past the receive buffer into request pages that are returned to the client through the Reply channel. Bound inline-range copies in svc_rdma_copy_inline_range() against the decoded inline RPC body saved in rc_saved_arg. Reject a single Read chunk positioned beyond that body, and reject multi-chunk lists where accumulated read bytes exceed the next chunk's position. Apply the same position and overlap checks in the call-chunk interleaving path.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.