CVE-2026-89529: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89529 Overview

CVE-2026-89529 is a Linux kernel vulnerability in the svcrdma (Server-Side RPC over RDMA) subsystem. The RPC/RDMA Read list decoder accepts wire-supplied segment lengths without bounds validation. An attacker sending crafted RPC/RDMA requests can trigger oversized dynamic bvec allocations and leak rw context resources when the post-allocation page-overrun guard fires. The flaw resides in the NFS server RDMA transport path, affecting Linux systems that export NFS over RDMA.

Critical Impact
Remote clients able to reach the RDMA-attached NFS server can trigger excessive kernel memory allocations and leak RDMA read-write contexts, degrading server availability over time.

Affected Products

Linux kernel svcrdma (NFS server RPC-over-RDMA transport)
Distributions shipping affected kernel versions prior to the upstream fix
Systems exporting NFS over RDMA (RoCE, InfiniBand, iWARP)

Discovery Timeline

2026-09-11 - CVE-2026-89529 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89529

Vulnerability Analysis

The vulnerability exists in the RPC/RDMA Read list decoding path within the Linux kernel's svcrdma server transport. The function xdr_count_read_segments() validates 4-byte alignment for non-zero position values but does not cap the segment length. As a result, an attacker-controlled rs_length value flows unchecked into svc_rdma_build_read_segment().

Inside svc_rdma_build_read_segment(), the nr_bvec count is derived directly from the oversized rs_length. This drives a large dynamic bvec allocation before the code verifies that enough rq_pages remain in the receive context. When the post-allocation page-overrun guard subsequently fires, the freshly acquired rw context is not returned to its pool, resulting in a resource leak.

Repeated exploitation exhausts kernel memory and RDMA read-write context pools, producing a denial-of-service condition on the NFS server.

Root Cause

The root cause is missing input validation on wire-supplied length fields during XDR decoding. The decoder trusts client-provided segment lengths without enforcing an upper bound consistent with the receive context's page budget. The behavior diverges from xdr_check_write_chunk(), which correctly bounds Write segment counts against rc_maxpages.

Attack Vector

An attacker with network reachability to an NFS-over-RDMA server sends an RPC/RDMA request containing a Read list with an oversized rs_length segment. The malformed segment triggers a large kernel allocation and leaks an rw context each time the overrun guard trips. No authentication-specific exploitation code is required beyond the ability to submit RPC/RDMA traffic.

The upstream fix rejects any Read segment whose length exceeds the receive context's page budget during decoding, and returns the rw context on the existing post-allocation overrun path in svc_rdma_build_read_segment().

Detection Methods for CVE-2026-89529

Indicators of Compromise

Unexpected growth in kernel slab allocations tied to bvec structures on NFS-over-RDMA servers
Gradual exhaustion of RDMA read-write contexts reported by the svcrdma subsystem
Kernel log entries from svc_rdma_build_read_segment() indicating page-overrun conditions

Detection Strategies

Monitor /proc/slabinfo for anomalous growth in RDMA-related caches on NFS servers
Enable kernel tracepoints on the sunrpc and rpcrdma subsystems to capture malformed Read list decoding events
Correlate NFS-over-RDMA client source addresses with spikes in server memory pressure

Monitoring Recommendations

Track kernel memory utilization trends on RDMA-enabled NFS servers and alert on sustained upward drift
Log dmesg output for svcrdma warnings and route to a centralized SIEM for correlation
Baseline expected NFS-over-RDMA client behavior and flag unusually large Read list requests

How to Mitigate CVE-2026-89529

Immediate Actions Required

Apply the upstream kernel patches referenced in the Kernel Git Commit 5120fe54 and Kernel Git Commit af6f0e06
Inventory all Linux systems exporting NFS over RDMA and prioritize kernel updates
Restrict RDMA network exposure to trusted NFS client subnets only

Patch Information

The fix rejects any Read segment whose length exceeds the receive context's page budget during Read list decoding, mirroring the bounds check performed by xdr_check_write_chunk() for Write segments. It also returns the rw context on the post-allocation overrun path in svc_rdma_build_read_segment(), keeping the defensive guard balanced. Deploy vendor kernel updates that incorporate these commits as soon as they become available for your distribution.

Workarounds

Disable NFS-over-RDMA transport where RDMA is not operationally required, falling back to TCP
Segment RDMA fabrics so only authenticated hosts can reach the NFS server's RDMA listener
Apply network-layer access controls to restrict which clients may negotiate RPC/RDMA connections