CVE-2026-89526: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89526 Overview

CVE-2026-89526 is a Linux kernel vulnerability in the svcrdma (server-side RPC over RDMA) subsystem. The flaw affects how the kernel validates Read chunk position fields supplied by remote RDMA clients. The xdr_count_read_segments() function verifies only 4-byte alignment and never compares the position against the received inline body length. A remote attacker can supply crafted Read chunk positions that trigger integer underflows during reconstruction, exposing adjacent slab memory to the upper XDR decoder or copying past the receive buffer into pages returned through the Reply channel.

Critical Impact
A network-adjacent attacker with RDMA access to an NFS server can leak adjacent kernel slab memory to remote clients without authentication or user interaction.

Affected Products

Linux kernel svcrdma (server-side RPC over RDMA) module
NFS servers exporting shares over RDMA transports
Kernel versions prior to the fixes in commits 3779b7b, 5770974, 5ab3f6d, and f84ec84d

Discovery Timeline

2026-09-11 - CVE-2026-89526 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89526

Vulnerability Analysis

The vulnerability resides in the RPC/RDMA Read chunk reconstruction path within svcrdma. Remote clients supply a ch_position field that the kernel stores verbatim in the parsed chunk list. The parser validates only that the value is 4-byte aligned. It never bounds-checks the position against the received inline RPC body length.

Two distinct code paths process this untrusted field. In the single-chunk path, svc_rdma_read_complete_one() splits the head and tail kvec buffers at ch_position. When the position exceeds the inline body, the tail length calculation underflows. This exposes adjacent slab memory to the upper XDR decoder.

In the multi-chunk path, svc_rdma_read_multiple_chunks() computes gap lengths between chunks using unsigned subtractions from ch_position. Overlapping Read chunks cause these subtractions to underflow. A final position past the inline body also underflows the trailing gap length. The subsequent svc_rdma_copy_inline_range() call then copies past the receive buffer into request pages returned to the client via the Reply channel.

Root Cause

The root cause is missing input validation of attacker-controlled length and position fields. The parser trusts ch_position values from the wire without comparing them against the actual inline body length or against prior chunk positions.

Attack Vector

Exploitation requires network access to an RDMA-enabled NFS server. An attacker sends crafted RPC/RDMA requests with Read chunk position fields set beyond the inline body, or with overlapping chunk positions in a multi-chunk list. The malformed request triggers underflow arithmetic in the reconstruction routines. Because the affected code path executes in kernel context before RPC-level authentication completes, no credentials are required. Verified proof-of-concept code has not been published at time of writing.

Detection Methods for CVE-2026-89526

Indicators of Compromise

Unexpected NFS/RDMA Reply messages containing unusual byte patterns from kernel slab memory
Kernel log entries referencing svc_rdma_read_complete_one, svc_rdma_read_multiple_chunks, or svc_rdma_copy_inline_range faults
Anomalous RDMA client connections issuing malformed RPC/RDMA headers to port 20049

Detection Strategies

Monitor kernel version telemetry across Linux endpoints and servers to identify hosts running vulnerable svcrdma code
Inspect NFS-over-RDMA traffic for RPC/RDMA Read chunks with position fields that exceed the inline body length
Correlate kernel oops or slab-corruption warnings with NFS/RDMA workloads to surface exploitation attempts

Monitoring Recommendations

Enable audit logging for the nfsd and rpcrdma kernel modules on servers exporting shares over RDMA
Track connection origins on TCP/UDP port 20049 and RoCE/InfiniBand fabrics for unexpected peers
Alert on repeated NFS server crashes or reboots that coincide with RDMA client activity

How to Mitigate CVE-2026-89526

Immediate Actions Required

Apply the upstream kernel fixes in commits 3779b7b, 5770974, 5ab3f6d, and f84ec84d
Restrict RDMA fabric access to authorized clients using network segmentation and fabric-level access controls
Disable NFS-over-RDMA on servers where this transport is not required for workloads

Patch Information

The fix bounds inline-range copies in svc_rdma_copy_inline_range() against the decoded inline RPC body saved in rc_saved_arg. The patch rejects single Read chunks positioned beyond that body and rejects multi-chunk lists where accumulated read bytes exceed the next chunk's position. The same position and overlap checks apply to the call-chunk interleaving path. Distribution maintainers should backport the referenced stable commits to supported kernel branches.

Workarounds

Remove the rdma transport from /etc/nfs.conf or unload the svcrdma kernel module where RDMA export is not required
Filter access to NFS-over-RDMA port 20049 at fabric ingress points and permit only trusted client subnets
Enforce mandatory access control policies (SELinux, AppArmor) to constrain the impact of nfsd compromise

bash

# Disable NFS server RDMA transport until patches are applied
sudo rpcdebug -m rpc -c
echo "options svcrdma disable=1" | sudo tee /etc/modprobe.d/disable-svcrdma.conf
sudo systemctl stop nfs-server
sudo modprobe -r svcrdma
sudo systemctl start nfs-server