CVE-2026-89528

What it actually does

A remote requester can trigger a NULL pointer dereference in the Linux kernel NFS/RDMA server (svcrdma). Per-segment Read lengths are checked at decode time, but cumulative length across multiple Read segments is not. When segments together exceed the rq_pages budget and one segment fills the array exactly, the runtime guard in svc_rdma_build_read_segment() is skipped (remaining length is zero) and a later segment indexes the NULL sentinel at rq_pages[rq_maxpages] during DMA mapping, oopsing or panicking the kernel. Impact is availability-only (no confidentiality or integrity loss).

Why it matters to the business

Hosts that serve NFS over RDMA can be crashed remotely without authentication, taking down file service and every other workload on the machine until reboot. The issue is not in CISA KEV, has no known in-the-wild exploitation (exploit maturity None), and is about 34 days post-publication; urgency still comes from the unauthenticated network path and High (7.5) availability impact on any system exposing NFS/RDMA.

How an attack unfolds

An attacker who can send RPC-over-RDMA traffic to a vulnerable nfsd instance submits a Read list made of several segments. Each segment passes the existing per-segment length check, but the combined page count exceeds the server page budget. One segment consumes the entire rq_pages array so the remaining-length guard is bypassed; the next segment then uses the NULL sentinel page pointer in DMA mapping, causing a kernel oops or panic and denying service on the host. No named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Install the Linux kernel update from your distribution that includes the svcrdma change to accumulate pages across all Read segments and reject the message at decode time when the total would overflow the page budget. If a patched kernel is not yet available, disable NFS-over-RDMA (do not enable RDMA for nfsd and do not load svcrdma), restrict network access to RDMA NFS endpoints, and reboot into the patched kernel as soon as it is released. No specific upstream version pins were supplied with this record; follow vendor/distro advisories for the exact package.

How to confirm the fix worked

Confirm the running kernel changelog or distro advisory lists this fix (svcrdma Read-list page-budget rejection). On each NFS server, verify whether svcrdma is loaded and whether nfsd RDMA is enabled; unpatched hosts with that transport on should be treated as exposed. After patching and reboot, confirm the module/kernel build includes the decode-time cumulative page check and that NFS-over-RDMA still functions for legitimate clients without oopses in dmesg or the journal.

Typical attack path

1. Locate a Linux host offering NFS over RDMA (svcrdma/nfsd RDMA transport).
2. Establish RPC-over-RDMA contact with that service.
3. Submit a Read list whose segments individually look valid but whose combined page count exceeds the server rq_pages budget.
4. Cause decode-time checks to succeed while the later Read-chunk builder indexes the NULL sentinel page during DMA mapping.
5. Induce a kernel oops or panic, taking NFS and the rest of the host offline until reboot.

How to detect it

This flaw crashes the kernel rather than leaving a userland implant, so look for already-occurred exploitation in kernel logs and crash dumps, not persistent malware. Review dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, kdump/vmcore, and panic console output around NFS/RDMA activity for BUG or Unable to handle kernel NULL pointer dereference reports whose call trace includes svc_rdma_build_read_segment or the svcrdma module, especially during DMA mapping of Read chunks. Correlate with NFS-over-RDMA service enablement (nfsd RDMA, loaded svcrdma) and inbound RPC-over-RDMA sessions (commonly port 20049). Unexpected reboots of NFS RDMA servers without a matching maintenance window are a secondary signal. There are no associated named threat actors; treat matching oopses as suspicious even if they may also be accidental.

• svc_rdma_build_read_segment
• [svcrdma]
• svcrdma:
• BUG: kernel NULL pointer dereference
• Unable to handle kernel NULL pointer dereference

What your security team should do

• Inventory Linux NFS servers and flag any with NFS-over-RDMA / svcrdma enabled as in-scope for this High-severity unauthenticated DoS.
• Patch and reboot those hosts using the vendor kernel that rejects oversized svcrdma Read lists at decode time; do not rely on the old runtime length guard.
• Until patched, disable nfsd RDMA or unload svcrdma and restrict access to RDMA NFS listeners.
• Hunt kernel logs and crash dumps for svcrdma NULL-pointer oopses (see detection guidance) even though there is no KEV listing or known exploit maturity.
• Track distro kernel advisories for this change and treat remaining exposed RDMA NFS endpoints as a residual availability risk.