CVE-2026-89530

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Reject inline replies that overflow the pull-up buffer

An RPC-over-RDMA client can request a reply, such as an NFS READ

payload, without providing a Write list or a Reply chunk to carry

it. When such a reply needs more scatter/gather entries than the

device's Send Queue supports, svc_rdma_pull_up_needed() selects

pull-up and svc_rdma_pull_up_reply_msg() linearizes the whole

reply into sctxt->sc_xprt_buf. That buffer is only sc_max_req_size

bytes, while the reply on this path is bounded only by the client's

request, so svc_rdma_xb_linearize() copies past the end of the

buffer and corrupts adjacent slab memory. The oversized length is

then stored in sc_sges[0].length and posted, so the device also

reads beyond the mapped region.

The SGE-exhaustion branch is the only pull-up path that can exceed

the buffer: the threshold branch pulls up only replies smaller

than RPCRDMA_PULLUP_THRESH, and replies that fit the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References