CVE-2026-89528
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
svcrdma: Reject Read lists that exceed the page budget
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed because len reaches zero. A subsequent segment then accesses the NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping. Accumulate pages across all Read segments and reject the message at decode time when the total would overflow the page budget.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 026d958b38c628a1b4ced534808945365e2747a5 | affected | git | beb4e9801f6362436102acc4cc5304b7324f9365 | Unavailable | None listed |
| 026d958b38c628a1b4ced534808945365e2747a5 | affected | git | e70fdb121171c3eb0ac34eb545721828cd737717 | Unavailable | None listed |
| 026d958b38c628a1b4ced534808945365e2747a5 | affected | git | 1a3af2262cb384112ef38632de4690682be528b4 | Unavailable | None listed |
| 026d958b38c628a1b4ced534808945365e2747a5 | affected | git | 465f511f59a0fa7a80d5d1073c4b24f28ea38f58 | Unavailable | None listed |
| 026d958b38c628a1b4ced534808945365e2747a5 | affected | git | 0ca487abb3bdf581851664b5db21f364caf57682 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4.13 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 4.13 | Unavailable | None listed |
| 6.6.160 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.114 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.51 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.4 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |