CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Validate Read chunk positions before reconstruction

The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments() checks only 4-byte alignment; it never compares the position against the received inline body length.

In the single-chunk path, svcrdmareadcompleteone() splits the head and tail kvecs at chposition. A position past the inline body underflows the tail length, exposing adjacent slab memory to the upper XDR decoder.

In the multi-chunk path, svcrdmareadmultiplechunks() computes gap lengths between chunks as unsigned subtractions from chposition. Overlapping Read chunks cause these subtractions to underflow. A final position past the inline body likewise underflows the trailing gap length. svcrdmacopyinlinerange() then copies past the receive buffer into request pages that are returned to the client through the Reply channel.

Bound inline-range copies in svcrdmacopyinlinerange() against the decoded inline RPC body saved in rcsavedarg. Reject a single Read chunk positioned beyond that body, and reject multi-chunk lists where accumulated read bytes exceed the next chunk's position. Apply the same position and overlap checks in the call-chunk interleaving path.