HIGH Introduced in 4.13
svcrdma ReadList Deref
CVE-2026-89528
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed because len reaches zero. A subsequent segment then accesses the NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping. Accumulate pages across all Read segments and reject the message at decode time when the total would overflow the page budget.
02KernelScan AI Analysis
Risk summary
A remote attacker who can reach an NFS server configured with RDMA transport can send a crafted RPC-over-RDMA request whose Read list exceeds the server's page budget, causing a NULL pointer dereference and kernel panic. No authentication or special privileges are required — the vulnerable decode path runs before RPC authentication. Any deployment exposing NFS/RDMA to untrusted networks is at risk of denial of service.
Vulnerability analysis
The NFS server's RDMA transport checks each incoming read segment's size on its own, but does not add up the sizes of all segments in one request. A malicious client can send many segments whose combined size exceeds the buffer reserved for incoming data. When earlier segments fill that buffer exactly, the server skips the remaining safety check and later tries to use an invalid address, crashing the kernel while preparing direct memory access. The fix totals all segment lengths while decoding the request and discards the whole message early if the combined size would overflow the buffer. Any remote client that can connect to an NFS server over RDMA can trigger this, because the vulnerable parsing happens before the server checks who sent the request.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 4.13 | 6.18.51 | 1a3af2262cb3 |
| 7.2 | 4.13 | 7.2.4 | 465f511f59a0 |
| mainline | 4.13 | 7.3-rc1 | 0ca487abb3bd |