CVE-2026-89529: svcrdma: Reject oversized Read segments at decode time
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Reject oversized Read segments at decode time
The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdrcountreadsegments() checks 4-byte alignment for non-zero position values but does not cap the segment length.
An oversized rslength reaches svcrdmabuildreadsegment(), which derives nrbvec from it and can drive a large dynamic bvec allocation before verifying that enough rqpages remain. If the post-allocation page-overrun guard fires, the freshly acquired rw context is not returned, leaking the resource.
Reject any segment whose length exceeds the receive context's page budget during Read list decoding, consistent with how xdrcheckwritechunk() bounds Write segment counts against rcmaxpages. Also return the rw context on the existing post-allocation overrun path in svcrdmabuildreadsegment(), keeping that defensive guard balanced.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel's RPC/RDMA server-side transport (svcrdma) are exposed when they process RPC/RDMA Read lists containing attacker-supplied segment lengths. The issue is in Read-list decoding and subsequent Read-segment construction.
What does an attacker need to send to trigger the vulnerable path?
An attacker needs to provide an RPC/RDMA Read segment with an oversized length. The length can pass the existing non-zero position alignment check because it was not bounded against the receive context's page budget during decoding.
What is the impact if an oversized segment is processed?
The oversized length can cause a large dynamic bvec allocation before the code verifies that sufficient request pages remain. If the later page-overrun guard triggers, the acquired read/write context can leak.
What mitigations are available if the fix cannot be applied immediately?
The provided information does not identify a configuration workaround. Reducing exposure to untrusted RPC/RDMA clients would limit opportunities to submit malicious Read lists.