Executive brief
The Linux kernel's RDMA (Remote Direct Memory Access) service module contains a validation flaw that allows a remote attacker to craft malicious read requests causing a NULL pointer dereference. This crashes the kernel, resulting in a denial of service on systems providing NFS or similar RDMA-based network services.
Technical details
The vulnerability exists in the svcrdma (RDMA service) component's read list validation logic. While individual read segments are validated for length, the code fails to accumulate and validate the cumulative length of multiple segments against the page budget (rq_pages array). When a single segment exactly fills the available page array, the runtime guard in svc_rdma_build_read_segment() is bypassed because the length counter reaches zero. A subsequent read segment then accesses a NULL sentinel value at rq_pages[rq_maxpages] during DMA mapping, triggering a NULL pointer dereference. The fix validates the total cumulative length across all read segments at decode time and rejects messages that would overflow the page budget.
Affected products
- Linux Linux kernel multiple versions (affected versions span from 2.6.11 through 6.11+, fix applied from 5.10 onwards in stable trees)
Timeline
- 2026-09-11: disclosed: CVE-2026-89528 published
- 2026-05-26: patched: Fix committed upstream (0ca487abb3bdf581851664b5db21f364caf57682)
- 2026-09-11: patched: Fix backported to stable kernel (1a3af2262cb384112ef38632de4690682be528b4)