CVE-2026-89528

The Linux kernel's svcrdma layer, which handles RPC-over-RDMA requests for the NFS server, validated each individual Read segment's length but failed to check the cumulative page count across all segments in a request. A malicious or buggy NFS client can send an RPC-over-RDMA message containing multiple Read segments whose combined length exceeds the server's rq_pages page budget, causing svc_rdma_build_read_segment() to walk past the end of the array and dereference the NULL sentinel slot during DMA mapping. The result is a kernel NULL pointer dereference, crashing the machine (or the affected execution path) and causing a denial of service; there is no impact on confidentiality or integrity. Only systems running an NFS server with the RDMA transport enabled (typically HPC and datacenter clusters with InfiniBand/RoCE fabrics) are exposed, and an attacker must be able to reach the RDMA listener, which is rarely internet-facing. There is no evidence of exploitation in the wild and no public proof of concept.

What to do: Apply your distribution's kernel update that includes the svcrdma fix, which now rejects any Read list whose cumulative page count exceeds rq_pages at decode time. If you do not need NFS over RDMA, verify the nfsd RDMA transport is not listening (typically port 20049) and disable it; systems without RPC-over-RDMA server support are unaffected. Where RDMA NFS is required, restrict the RDMA listener to trusted client networks, since the flaw is triggerable by any unauthenticated client that can reach it.