CVE-2026-13087
Received Received - Intake

Heap Out-of-Bounds Write in Linux Kernel RPC-over-RDMA

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: redhat-SADP

Description
A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire multi-page reply into a fixed-size 4096-byte heap buffer without bounds checking, resulting in a kernel heap overflow. This can lead to denial of service via kernel crash or potential code execution through corruption of adjacent kernel heap objects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-13087
EUVD
EUVD-2026-84560

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 2.11.0 (inc)
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-13087 is a heap out-of-bounds write vulnerability in the Linux kernel's RPC-over-RDMA server reply path. When a crafted client sends a large NFS READ request with an empty Write list and no Reply chunk, the server incorrectly linearizes a multi-page reply into a fixed 4096-byte heap buffer without bounds checking. This causes a kernel heap overflow, potentially crashing the system or enabling code execution.

Detection Guidance

To detect this vulnerability, check if your system is running NFS over RDMA by verifying if the svcrdma kernel module is loaded. Use commands like 'lsmod | grep svcrdma' or 'modinfo svcrdma'. Inspect network traffic for large NFS READ requests with empty Write lists and no Reply chunk. Monitor kernel logs for crashes or heap corruption errors.

Impact Analysis

This vulnerability can lead to denial of service via kernel crashes or potential code execution through heap corruption. Exploitation requires network access to the NFS/RDMA service, valid NFS credentials, and a specifically crafted client. Systems using NFS over RDMA with default configurations are at risk.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially allowing unauthorized code execution or data corruption on systems handling sensitive data. A successful exploit could lead to unauthorized access, data breaches, or service disruption, which are critical violations under these regulations. The high CVSS score (8.8) indicates significant risk to confidentiality, integrity, and availability of affected systems.

Mitigation Strategies

If NFS over RDMA is not required, disable the svcrdma kernel module using 'modprobe -r svcrdma'. Restrict network access to NFS/RDMA services via firewalls. Update kernel versions if patches become available. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13087. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart