{"id":"CVE-2026-89530","state":"PUBLISHED","title":"svcrdma: Reject inline replies that overflow the pull-up buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject inline replies that overflow the pull-up buffer\n\nAn RPC-over-RDMA client can request a reply, such as an NFS READ\npayload, without providing a Write list or a Reply chunk to carry\nit. When such a reply needs more scatter/gather entries than the\ndevice's Send Queue supports, svc_rdma_pull_up_needed() selects\npull-up and svc_rdma_pull_up_reply_msg() linearizes the whole\nreply into sctxt->sc_xprt_buf. That buffer is only sc_max_req_size\nbytes, while the reply on this path is bounded only by the client's\nrequest, so svc_rdma_xb_linearize() copies past the end of the\nbuffer and corrupts adjacent slab memory. The oversized length is\nthen stored in sc_sges[0].length and posted, so the device also\nreads beyond the mapped region.\n\nThe SGE-exhaustion branch is the only pull-up path that can exceed\nthe buffer: the threshold branch pulls up only replies smaller\nthan RPCRDMA_PULLUP_THRESH, and replies that fit the device's SGE\nbudget are sent directly without linearization. Make\nsvc_rdma_pull_up_needed() report -E2BIG when the reply it would\npull up cannot fit sc_max_req_size, and fail the request with\nERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping\nthe connection.\n\nThe helper no longer answers a simple yes/no question: it now\nreports pull-up, no pull-up, or -E2BIG for a reply too large to\nlinearize. Rename svc_rdma_pull_up_needed() to\nsvc_rdma_check_pull_up() so its name no longer implies a boolean\npredicate.","publishedAt":"2026-09-11T19:44:10.024Z","updatedAt":"2026-10-30T12:32:01.396Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e248aa7be86e8179f20ac0931774ecd746f3f5bf","status":"affected","lessThan":"b73011049dbe909f73fd9620d94ef1757d7af2eb","versionType":"git"},{"version":"e248aa7be86e8179f20ac0931774ecd746f3f5bf","status":"affected","lessThan":"8068358f445a11296328ffa7c524701596814a17","versionType":"git"},{"version":"e248aa7be86e8179f20ac0931774ecd746f3f5bf","status":"affected","lessThan":"fcd91b9957462d398792201c239dffaeff1cc8b2","versionType":"git"},{"version":"e248aa7be86e8179f20ac0931774ecd746f3f5bf","status":"affected","lessThan":"1949dd1576f7a8aa161b1330c6125df9d53046d5","versionType":"git"},{"version":"e248aa7be86e8179f20ac0931774ecd746f3f5bf","status":"affected","lessThan":"8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf","versionType":"git"},{"version":"e248aa7be86e8179f20ac0931774ecd746f3f5bf","status":"affected","lessThan":"0fbe20dfe74b783d255bf389a6ea77aa25dc7860","versionType":"git"},{"version":"9b65b18f817d9ada2bf67351f24bdcce6789a0bb","status":"affected","versionType":"git"},{"version":"d564356e1919d1178568c19af410cfc1a9076663","status":"affected","versionType":"git"},{"version":"4.19.22","status":"affected","lessThan":"4.20","versionType":"semver"},{"version":"4.20.9","status":"affected","lessThan":"4.21","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/xprtrdma/svc_rdma_sendto.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.0","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/xprtrdma/svc_rdma_sendto.c"]}],"references":["https://git.kernel.org/stable/c/b73011049dbe909f73fd9620d94ef1757d7af2eb","https://git.kernel.org/stable/c/8068358f445a11296328ffa7c524701596814a17","https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2","https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5","https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf","https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860"],"weaknesses":[],"ingestedAt":"2026-10-30T12:50:04.827Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89530.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89530","state":"PUBLISHED","datePublished":"2026-09-11T19:44:10.024Z","dateUpdated":"2026-10-30T12:32:01.396Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.719Z"},"containers":{"cna":{"title":"svcrdma: Reject inline replies that overflow the pull-up buffer","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject inline replies that overflow the pull-up buffer\n\nAn RPC-over-RDMA client can request a reply, such as an NFS READ\npayload, without providing a Write list or a Reply chunk to carry\nit. When such a reply needs more scatter/gather entries than the\ndevice's Send Queue supports, svc_rdma_pull_up_needed() selects\npull-up and svc_rdma_pull_up_reply_msg() linearizes the whole\nreply into sctxt->sc_xprt_buf. That buffer is only sc_max_req_size\nbytes, while the reply on this path is bounded only by the client's\nrequest, so svc_rdma_xb_linearize() copies past the end of the\nbuffer and corrupts adjacent slab memory. The oversized length is\nthen stored in sc_sges[0].length and posted, so the device also\nreads beyond the mapped region.\n\nThe SGE-exhaustion branch is the only pull-up path that can exceed\nthe buffer: the threshold branch pulls up only replies smaller\nthan RPCRDMA_PULLUP_THRESH, and replies that fit the device's SGE\nbudget are sent directly without linearization. Make\nsvc_rdma_pull_up_needed() report -E2BIG when the reply it would\npull up cannot fit sc_max_req_size, and fail the request with\nERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping\nthe connection.\n\nThe helper no longer answers a simple yes/no question: it now\nreports pull-up, no pull-up, or -E2BIG for a reply too large to\nlinearize. Rename svc_rdma_pull_up_needed() to\nsvc_rdma_check_pull_up() so its name no longer implies a boolean\npredicate."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e248aa7be86e8179f20ac0931774ecd746f3f5bf","status":"affected","lessThan":"b73011049dbe909f73fd9620d94ef1757d7af2eb","versionType":"git"},{"version":"e248aa7be86e8179f20ac0931774ecd746f3f5bf","status":"affected","lessThan":"8068358f445a11296328ffa7c524701596814a17","versionType":"git"},{"version":"e248aa7be86e8179f20ac0931774ecd746f3f5bf","status":"affected","lessThan":"fcd91b9957462d398792201c239dffaeff1cc8b2","versionType":"git"},{"version":"e248aa7be86e8179f20ac0931774ecd746f3f5bf","status":"affected","lessThan":"1949dd1576f7a8aa161b1330c6125df9d53046d5","versionType":"git"},{"version":"e248aa7be86e8179f20ac0931774ecd746f3f5bf","status":"affected","lessThan":"8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf","versionType":"git"},{"version":"e248aa7be86e8179f20ac0931774ecd746f3f5bf","status":"affected","lessThan":"0fbe20dfe74b783d255bf389a6ea77aa25dc7860","versionType":"git"},{"version":"9b65b18f817d9ada2bf67351f24bdcce6789a0bb","status":"affected","versionType":"git"},{"version":"d564356e1919d1178568c19af410cfc1a9076663","status":"affected","versionType":"git"},{"version":"4.19.22","status":"affected","lessThan":"4.20","versionType":"semver"},{"version":"4.20.9","status":"affected","lessThan":"4.21","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/xprtrdma/svc_rdma_sendto.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.0","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/xprtrdma/svc_rdma_sendto.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/b73011049dbe909f73fd9620d94ef1757d7af2eb"},{"url":"https://git.kernel.org/stable/c/8068358f445a11296328ffa7c524701596814a17"},{"url":"https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2"},{"url":"https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5"},{"url":"https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf"},{"url":"https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - svcrdma is nfsd's RPC-over-RDMA server transport; a remote NFS/RDMA client reaches svc_rdma_sendto over InfiniBand, RoCE, or iWARP, including IP-routable RoCEv2/iWARP and Soft-RoCE, so this is a network attack.\nAC:L - The attacker fully controls omitting the Write list and Reply chunk and the NFS READ size; with the default 4096-byte pull-up buffer and ~5 Send SGEs, a multi-page inline READ deterministically takes the SGE-exhaustion pull-up path and overflows, with no race or uncontrollable layout.\nPR:N - RDMA-CM accept has no credential check, and AUTH_NULL/AUTH_UNIX need no real account; default NFS exports accept those flavors, so a fabric peer can drive a large READ reply without local or init-namespace privileges.\nUI:N - Exploitation requires only attacker-sent RPC-over-RDMA Calls that elicit a large inline reply; no victim mount, click, or other user action is needed beyond nfsd already listening on RDMA.\nS:U - The kmalloc overflow and oversized RDMA Send stay inside the host kernel's security authority; this is not a VM, IOMMU, or sandbox escape.\nC:H - svc_rdma_xb_linearize() copies past kmalloc sc_xprt_buf, then the inflated sc_sges[0].length is posted with the PD local DMA lkey, so the device reads adjacent kernel memory onto the wire; the heap smash is also leveragable for disclosure.\nI:H - The unbounded memcpy is a heap out-of-bounds write of attacker-influenced NFS READ payload into adjacent slab objects, enabling corruption of neighboring kernel state and control-flow hijacking.\nA:H - Overflowing a 4KB send buffer by up to the NFS/RDMA max payload smashes adjacent slab and can oops or panic, and posting an SGE longer than the DMA mapping can also fault the device or kernel."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:32:01.396Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"7.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.22"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20.9"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-89530","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T19:23:07.762867Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:26:41.231Z"}}]}}}