CVE-2026-89528: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89528 Overview

CVE-2026-89528 is a NULL pointer dereference vulnerability in the Linux kernel's svcrdma (SUNRPC server-side Remote Direct Memory Access) subsystem. A remote requester can craft an RDMA Read list whose cumulative segment lengths exceed the rq_pages array budget, bypassing per-segment validation. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is skipped because len reaches zero. A subsequent segment then accesses the NULL sentinel at rq_pages[rq_maxpages], triggering a NULL pointer dereference during DMA mapping. The flaw is exploitable over the network without authentication and results in a kernel crash.

Critical Impact
Remote, unauthenticated attackers can crash any Linux server exposing NFS-over-RDMA endpoints by sending a malformed RPC message, resulting in denial of service.

Affected Products

Linux kernel builds that include the svcrdma server-side RDMA transport for SUNRPC (NFS server over RDMA)
Linux distributions shipping affected stable kernel branches prior to the fixes referenced in commits 0ca487abb3, 1a3af2262c, and 465f511f59
Systems exposing NFS-over-RDMA services (InfiniBand, RoCE, or iWARP fabrics)

Discovery Timeline

2026-09-11 - CVE-2026-89528 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89528

Vulnerability Analysis

The vulnerability resides in the server-side RDMA transport layer used by the Linux kernel NFS server. When an RPC client transmits a Read chunk list, the kernel decodes each Read segment and allocates pages from the request's rq_pages array to receive the inbound data via RDMA Read operations.

Individual segment lengths are validated at decode time, but the decoder does not accumulate lengths across segments. A requester can therefore split a large transfer into multiple segments whose combined length exceeds the total page budget for the request. The kernel then walks off the end of the page array during subsequent RDMA setup.

Root Cause

The helper svc_rdma_build_read_segment() contains a runtime guard that decrements len as pages are consumed. When one segment consumes the entire remaining budget, len reaches zero and the guard exits cleanly. Processing then moves to the next Read segment. The next segment begins reading pages starting at rq_pages[rq_maxpages], which the SUNRPC layer initializes to a NULL sentinel. Dereferencing that slot during DMA mapping crashes the kernel. The defect is a missing cumulative bounds check, resulting in a NULL pointer dereference [CWE-476] reachable via out-of-bounds indexing of the page array.

Attack Vector

Exploitation requires network reachability to an RDMA-capable NFS server port. No authentication or user interaction is required, since the malformed Read list is processed during initial RPC decoding. The attacker sends a crafted RPC message containing multiple Read segments whose cumulative page count exceeds rq_maxpages. The kernel accepts the message at decode time, then dereferences the NULL sentinel during DMA mapping and panics. Confidentiality and integrity are not affected; availability of the target host is lost until reboot.

No verified public proof-of-concept code is available. See the upstream fix commits for the exact patched decode path.

Detection Methods for CVE-2026-89528

Indicators of Compromise

Kernel oops or panic entries in dmesg or /var/log/messages referencing svc_rdma_build_read_segment, svc_rdma_recv_read_chunk, or NULL pointer dereferences within the rpcrdma or svcrdma modules
Unexpected NFS server process termination or host reboot correlated with inbound RDMA traffic
Abnormal RPC Read chunk messages containing multiple segments summing to more than the negotiated maximum request size

Detection Strategies

Enable kernel crash dump collection (kdump) on NFS-over-RDMA servers to capture stack traces from the svcrdma module for post-incident analysis
Monitor RDMA connection counters and NFS server uptime metrics for unexplained resets
Deploy endpoint telemetry that surfaces kernel oops events and correlates them with the source IP of active RDMA peers

Monitoring Recommendations

Alert on repeated NFS server restarts on hosts running affected kernel versions
Track inbound connections to InfiniBand, RoCE, and iWARP ports from unexpected client subnets
Ingest kernel ring buffer messages into a centralized log platform and alert on BUG: unable to handle or NULL pointer dereference strings originating from sunrpc or rpcrdma

How to Mitigate CVE-2026-89528

Immediate Actions Required

Inventory all Linux hosts running an NFS server with the RDMA transport enabled and confirm kernel versions against the upstream fix commits
Apply the patched stable kernel that includes commits 0ca487abb3, 1a3af2262c, or 465f511f59 as appropriate for the deployed branch
Restrict access to RDMA-capable NFS ports to trusted client subnets using host or fabric-level access controls until patches are deployed

Patch Information

The fix accumulates the page count across all Read segments during decode and rejects any RPC message whose cumulative segment length would overflow the rq_pages budget. Patched kernels are available via the following upstream commits: Linux Kernel Commit 0ca487abb3, Linux Kernel Commit 1a3af2262c, and Linux Kernel Commit 465f511f59. Rebuild or update to a distribution kernel containing these fixes and reboot the affected hosts.

Workarounds

Disable the NFS-over-RDMA transport on the server by unloading the svcrdma module (rmmod svcrdma) or by omitting rdma from the NFS server transport configuration until patches are applied
Enforce network segmentation so that only known NFS-over-RDMA clients can reach the server's RDMA listener port
Continue to serve NFS traffic over TCP transports, which are not affected by this decode path

bash

# Configuration example: disable NFS-over-RDMA transport on the server
sudo systemctl stop nfs-server
sudo rmmod svcrdma 2>/dev/null || true
# Prevent the module from loading on boot
echo 'blacklist svcrdma' | sudo tee /etc/modprobe.d/blacklist-svcrdma.conf
sudo systemctl start nfs-server
# Verify only TCP transports are advertised
cat /proc/fs/nfsd/portlist