Executive brief
The Linux kernel's NVMe-over-RDMA target subsystem contains a buffer handling flaw in its inline data offset mapping. When a port is configured with inline data buffers larger than a page, an attacker can craft a specially offset request that causes the kernel to read far past the intended buffer boundary—up to 4 GiB—potentially exposing sensitive kernel memory or system data. This affects systems using NVMe-over-RDMA storage targets.
Technical details
The vulnerability is a buffer over-read in nvmet_rdma_use_inline_sg(), which maps host-controlled inline data offsets into scatterlist entries. The function's bounds check allows offsets where off + len ≤ inline_data_size, but the scatterlist mapping incorrectly assumes data begins in the first page. When inline_data_size > PAGE_SIZE (configurable up to 16 KiB), an offset in (PAGE_SIZE, inline_data_size] causes integer underflow in "PAGE_SIZE - off", setting sg->length to approximately 4 GiB. The block backend then reads far past the intended inline page. Attack requires network access to an NVMe-over-RDMA target and the ability to issue NVMe commands with crafted offsets; no authentication bypass is needed if the target is network-accessible. The patch fixes this by splitting the offset into a page index and in-page offset, properly initializing the scatterlist at the correct page, and updating boundary checks in nvmet_rdma_release_rsp(). A fix has been merged into the Linux kernel.
Affected products
- Linux Linux kernel all versions with nvmet-rdma (introduced in commit 0d5ee2b2ab4f)
Timeline
- 2026-08-15: disclosed: CVE-2026-72129 published
- 2026-06-04: patched: Patch authored by Bryam Vargas
- 2026-07-24: patched: Merged into stable kernel by Greg Kroah-Hartman