CVE-2026-89528: svcrdma: Reject Read lists that exceed the page budget
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Reject Read lists that exceed the page budget
Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rqpages array budget. When one segment fills the page array exactly, the runtime guard in svcrdmabuildreadsegment() is bypassed because len reaches zero. A subsequent segment then accesses the NULL sentinel slot at rqpages[rqmaxpages], resulting in a NULL pointer dereference during DMA mapping.
Accumulate pages across all Read segments and reject the message at decode time when the total would overflow the page budget.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
svcrdma: Reject Read lists that exceed the rq_pages array page budget to prevent the NULL pointer dereference during segment fills.
Event History
Frequently Asked Questions
What must an attacker send to trigger the flaw?
The requester must send multiple RDMA Read segments whose combined page requirement exceeds the rq_pages array budget. Individual segment lengths can be valid, so per-segment validation alone does not prevent the condition.
What happens when the page budget is exceeded?
If an earlier segment exactly fills the page array, a subsequent segment can access the NULL sentinel at rq_pages[rq_maxpages]. This causes a NULL pointer dereference during DMA mapping.