CVE-2026-72129

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-rdma: handle inline data with a nonzero offset

nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset

into the per-command inline scatterlist. The bounds check admits any

offset with off + len <= inline_data_size, but the mapping still assumes

the data begins in the first inline page:

sg->offset = off;

sg->length = min_t(int, len, PAGE_SIZE - off);

When a port is configured with inline_data_size > PAGE_SIZE (settable up

to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size]

makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and

the block backend reads far past the first inline page. num_pages(len)

also ignores the offset, so an in-bounds offset whose [off, off+len)

span crosses a page boundary under-counts the scatterlist.

Map the offset properly: split it into a page index and an in-page

offset, start the scatterlist at that page, and size the page count fr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References