CVE-2026-93228

Received Received - Intake

Denial of Service in Linux Kernel NFS over RDMA

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdr_check_write_chunk() only rejects segcount > rc_maxpages, so zero passes the range check, and xdr_inline_decode(stream, 0) returns the current (non-NULL) cursor without advancing. The function returns true and pcl_alloc_write() then links a struct svc_rdma_chunk with ch_segcount == 0 onto rc_write_pcl or rc_reply_pcl. An earlier patch in this series made pcl_for_each_segment() safe for ch_segcount == 0, so this no longer drives the memory walk it used to. Rejecting the malformed frame at the decode boundary is still worthwhile as defense in depth: it keeps degenerate zero-segment chunks off the parsed chunk lists entirely, so any future consumer that walks ch_segments directly cannot observe one, and it makes the zero-floor easy to backport to trees where the macro change is more intrusive. RFC 8166 has no meaning for a Write/Reply chunk that describes no remote buffer, so no legitimate client is affected. xdr_check_reply_chunk() funnels Reply chunks through xdr_check_write_chunk() and inherits the same rejection. pcl_alloc_write() also links each chunk onto the parsed chunk list before filling its segment array. If a future change weakens the segcount-0 rejection, an incomplete chunk is visible to consumers during the fill loop. Reorder so that list_add_tail() follows the segment fill loop, ensuring only fully-populated chunks appear on the list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-09-25

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-93228

EUVD

EUVD-2026-86233

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves the Linux kernel's svcrdma module where a peer can send a malformed Write or Reply chunk with a segcount field set to zero. The kernel's validation function xdr_check_write_chunk() only checks if segcount exceeds a maximum value, allowing zero to pass. This leads to incorrect handling where a chunk with zero segments is linked to internal lists, potentially causing issues if future code changes or consumers interact with these malformed chunks.

Detection Guidance

This vulnerability is specific to the Linux kernel's svcrdma module and involves malformed Write/Reply chunks with a segcount of zero. Detection would require inspecting network traffic for NFS over RDMA (NFS-RDMA) packets with zero segment counts in Write or Reply chunks. Use tools like tcpdump or Wireshark to capture and analyze NFS-RDMA traffic for malformed chunks.

Impact Analysis

The impact is limited as the vulnerability is defensive. It allows a peer to send invalid network traffic that the kernel now rejects early. No legitimate client is affected since RFC 8166 does not allow zero-segment chunks. The main risk is if future code changes weaken the validation, potentially exposing the kernel to unexpected behavior from malformed chunks.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue in the Linux svcrdma module that could allow malformed network traffic to cause undefined behavior. Compliance impacts would only occur if exploitation led to unauthorized data access or service disruption, which is not indicated in the provided details.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version that includes the fix for the svcrdma module. If patching is not immediately possible, consider disabling NFS over RDMA (NFS-RDMA) as a temporary workaround until the patch can be applied.

Hi! I’m here to help you understand CVE-2026-93228. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70