CVE-2026-89528
Received Received - Intake

svcrdma Read List Page Budget Overflow in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed because len reaches zero. A subsequent segment then accesses the NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping. Accumulate pages across all Read segments and reject the message at decode time when the total would overflow the page budget.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89528
EUVD
EUVD-2026-76434

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's svcrdma module. It occurs when a requester sends multiple read segments whose combined length exceeds the allowed page budget. The kernel fails to validate the total length properly, allowing a segment to access a NULL sentinel slot in the page array during DMA mapping, leading to a crash.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the Linux kernel's svcrdma module due to improper validation of Read segment lengths. Detection requires kernel-level monitoring for crashes or errors in NFS over RDMA services. Check kernel logs for NULL pointer dereference errors or system crashes related to svcrdma. Use commands like 'dmesg | grep svcrdma' or 'journalctl -k | grep -i null' to identify suspicious activity.

Impact Analysis

This vulnerability could cause a denial-of-service (DoS) condition on affected systems by crashing the kernel when processing malicious RPC-over-RDMA requests. Systems using NFS over RDMA or other RPC-based services could become unresponsive.

Mitigation Strategies

Apply the latest Linux kernel patches to address the svcrdma vulnerability. Disable NFS over RDMA services if not required. Monitor kernel logs for signs of exploitation. Update affected systems immediately to a patched kernel version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89528. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart