Cloudanix VulnDB

CVE-2026-89529

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in Linux high-speed file sharing can let someone send a malformed request that wastes internal resources until shared storage stops responding.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The Linux kernel RPC/RDMA server (svcrdma) accepts attacker-controlled Read-list segment lengths during XDR decode without capping them against the receive-context page budget. Those lengths later drive a large dynamic bvec allocation in svc_rdma_build_read_segment(); if the post-allocation page-overrun guard then fires, the newly acquired RDMA read-write context is not returned. The result is a kernel resource leak and potentially large transient allocations that can deny service on the NFS/RPC RDMA path and pressure kernel memory.

Why it matters to the business

Hosts that export NFS or other RPC services over RDMA can become unresponsive or exhaust memory, interrupting high-performance file sharing and storage. This issue is a denial-of-service class flaw, is not listed in CISA KEV, has no reported ransomware use, and has no public exploit maturity 34 days after publication, so mass opportunistic exploitation is not indicated. Residual operational risk is highest where RDMA NFS is production-critical and kernel updates lag.

How an attack unfolds

An unauthenticated or already-connected peer that can speak RPC/RDMA to a vulnerable nfsd/svcrdma listener supplies a Read list whose wire segment lengths exceed the server receive-context page budget. Decode stores those lengths without a cap; later build logic allocates from them and can leak the associated rw context when the overrun guard trips. Repeating the exchange accumulates leaked RDMA contexts and memory pressure until RDMA RPC handling fails or the host is starved. No named threat actors or campaigns are associated with this CVE.

How to fix it

Install a Linux kernel build that includes the svcrdma change to reject oversized Read segments at decode time (consistent with how Write chunks are bounded) and to return the rw context on the existing post-allocation overrun path in svc_rdma_build_read_segment(). Specific distro package versions were not supplied with this record, so take the patched kernel from your distribution or upstream stable tree and verify the fix is present. If NFS/RPC over RDMA is not required, unload or disable svcrdma/rpcrdma until patched, and keep RDMA and NFS listeners off untrusted networks.

How to confirm the fix worked

Confirm the running kernel changelog, package advisory, or source contains the Read-list length cap during decode and the rw-context return on the overrun path. After upgrade, restart nfsd/RPC RDMA services and verify they start cleanly. On systems not yet patched, inventory whether svcrdma/rpcrdma and nfsd RDMA are loaded and whether RDMA devices are in use. Do not validate by sending oversized Read segments at production servers; use version and configuration evidence only.

Typical attack path

  1. Discover Linux hosts offering NFS or RPC over RDMA (InfiniBand, RoCE, or iWARP).
  2. Reach the RPC/RDMA server on the RDMA fabric or exposed listener.
  3. Send RPC/RDMA Read-list traffic with segment lengths larger than the server page budget.
  4. Repeat the malformed Read-list traffic to leak rw contexts and force large allocations.
  5. Cause NFS-over-RDMA failure, connection loss, or host memory exhaustion.

How to detect it

No in-the-wild exploitation, KEV listing, or named-actor activity is reported. Hunt for unexplained kernel memory or RDMA resource growth on NFS servers, nfsd/svcrdma loaded followed by hung NFS-over-RDMA clients or OOM, and kernel/syslog entries for sunrpc/svcrdma around service degradation. Correlate RDMA connection and NFS server stats with bursts of failed Read-list handling from untrusted clients. A leak-style DoS may leave few crisp artifacts, so pair logs with host health (memory, slab, RDMA resource counts).

What your security team should do

  • Patch kernels first on hosts that load svcrdma/rpcrdma or export NFS over RDMA.
  • Inventory RDMA-capable NFS/RPC servers and restrict those listeners to trusted fabrics.
  • Disable unused RPC/RDMA server modules until the kernel fix is installed.
  • Watch kernel memory, RDMA resource usage, and nfsd availability for unexplained degradation.
  • Track distribution stable backports of this svcrdma change; no KEV due date applies.

The record

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdr_count_read_segments() checks 4-byte alignment for non-zero position values but does not cap the segment length. An oversized rs_length reaches svc_rdma_build_read_segment(), which derives nr_bvec from it and can drive a large dynamic bvec allocation before verifying that enough rq_pages remain. If the post-allocation page-overrun guard fires, the freshly acquired rw context is not returned, leaking the resource. Reject any segment whose length exceeds the receive context's page budget during Read list decoding, consistent with how xdr_check_write_chunk() bounds Write segment counts against rc_maxpages. Also return the rw context on the existing post-allocation overrun path in svc_rdma_build_read_segment(), keeping that defensive guard balanced.

Affected packages

Ecosystem Package Introduced Fixed