CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Validate Read chunk positions before reconstruction
The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments() checks only 4-byte alignment; it never compares the position against the received inline body length.
In the single-chunk path, svcrdmareadcompleteone() splits the head and tail kvecs at chposition. A position past the inline body underflows the tail length, exposing adjacent slab memory to the upper XDR decoder.
In the multi-chunk path, svcrdmareadmultiplechunks() computes gap lengths between chunks as unsigned subtractions from chposition. Overlapping Read chunks cause these subtractions to underflow. A final position past the inline body likewise underflows the trailing gap length. svcrdmacopyinlinerange() then copies past the receive buffer into request pages that are returned to the client through the Reply channel.
Bound inline-range copies in svcrdmacopyinlinerange() against the decoded inline RPC body saved in rcsavedarg. Reject a single Read chunk positioned beyond that body, and reject multi-chunk lists where accumulated read bytes exceed the next chunk's position. Apply the same position and overlap checks in the call-chunk interleaving path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.109 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.50 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Validate RPC/RDMA Read chunk positions before reconstruction: reject a single Read chunk positioned beyond the decoded inline RPC body, reject multi-chunk lists where accumulated read bytes exceed the next chunk's position, and apply the same position and overlap checks in the call-chunk interleaving path.
- Compensating control
Bound inline-range copies in svc_rdma_copy_inline_range() against the decoded inline RPC body saved in rc_saved_arg so copying cannot extend past the receive buffer into request pages.
Event History
Frequently Asked Questions
Who can trigger this issue?
A remote RPC/RDMA client can supply the Read chunk position values that reach the vulnerable parsing and reconstruction paths. Exploitation requires sending malformed Read chunks, including positions beyond the received inline RPC body or overlapping chunks.
What could a successful attack expose?
Malformed chunk positions can cause unsigned length underflows and copies beyond the receive buffer. Adjacent slab memory may be exposed to the upper XDR decoder or copied into request pages returned to the client through the Reply channel.
Are both single- and multi-chunk requests relevant?
Yes. A single Read chunk positioned beyond the inline body affects the single-chunk reconstruction path, while overlapping chunks or a final chunk beyond the inline body affect the multi-chunk path.