CVE-2026-89530: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89530 Overview

CVE-2026-89530 is a heap buffer overflow in the Linux kernel's svcrdma server module, which implements Remote Procedure Call over Remote Direct Memory Access (RPC-over-RDMA) transport for services like NFS. The flaw exists in the pull-up path used to linearize inline replies when the target device's Send Queue lacks sufficient scatter/gather entries. A remote RPC-over-RDMA client can request a reply larger than the fixed sc_max_req_size pull-up buffer, causing svc_rdma_xb_linearize() to write past the buffer and corrupt adjacent slab memory. The kernel then posts the oversized length to the RDMA device, which reads beyond the mapped region.

Critical Impact
An unauthenticated network attacker with RPC-over-RDMA reachability can trigger kernel slab corruption on NFS-over-RDMA servers, enabling denial of service or potential remote code execution in kernel context.

Affected Products

Linux kernel builds exposing the svcrdma (RPC-over-RDMA server) transport
NFS servers configured with RDMA transport (rdma mount / listen option)
Kernel branches prior to the fixes referenced in commits 0fbe20d, 1949dd1, 8ec60eb, and fcd91b9

Discovery Timeline

2026-09-11 - CVE-2026-89530 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89530

Vulnerability Analysis

An RPC-over-RDMA client can request a reply (for example, an NFS READ payload) without providing a Write list or a Reply chunk to carry the response. When the resulting reply requires more scatter/gather entries than the RDMA device's Send Queue supports, svc_rdma_pull_up_needed() selects the pull-up path and calls svc_rdma_pull_up_reply_msg() to linearize the entire reply into sctxt->sc_xprt_buf.

That buffer is fixed at sc_max_req_size bytes. The reply size on this path is bounded only by the client's request, not by the buffer capacity. svc_rdma_xb_linearize() copies past the end of the buffer and corrupts adjacent slab objects. The oversized length is then stored in sc_sges[0].length and posted to the device, causing an out-of-bounds read from the mapped region during Send processing.

Root Cause

The pull-up decision helper made a boolean determination without validating that the reply would fit in the destination buffer. Two other pull-up branches are safe: the threshold branch only linearizes replies smaller than RPCRDMA_PULLUP_THRESH, and replies fitting the device's SGE budget bypass linearization entirely. Only the SGE-exhaustion branch could exceed sc_max_req_size, and it lacked a size guard, resulting in a classic heap overflow driven by attacker-controlled reply sizing.

Attack Vector

A remote client speaking RPC-over-RDMA to a vulnerable server can craft a request that elicits a reply large enough to exhaust the device's SGE budget while omitting a Write list or Reply chunk. This forces the server into the SGE-exhaustion pull-up branch and overflows sctxt->sc_xprt_buf. The attack requires network reachability to the RDMA transport but no authentication material beyond what the RPC service exposes. Exploitation corrupts kernel slab memory, which can produce panics or, with careful shaping, escalate to kernel-mode code execution.

No public proof-of-concept has been published. See the upstream fixes for the corrected control flow.

Detection Methods for CVE-2026-89530

Indicators of Compromise

Kernel oops or panic messages referencing svc_rdma_pull_up_reply_msg, svc_rdma_xb_linearize, or slab corruption on NFS-over-RDMA servers.
KASAN reports of out-of-bounds writes into sc_xprt_buf on kernels built with address sanitization.
RDMA completion errors indicating local length or protection errors on Send Work Requests originating from svcrdma.

Detection Strategies

Monitor kernel ring buffer (dmesg) for svcrdma warnings and unexpected ERR_CHUNK responses correlated with client disconnects.
Inventory Linux hosts running NFS-over-RDMA and cross-reference against patched kernel versions from the referenced stable commits.
Baseline expected RPC-over-RDMA client identities and alert on anomalous or unauthorized initiators of large inline replies.

Monitoring Recommendations

Forward kernel logs and RDMA subsystem telemetry to a centralized analytics pipeline for correlation with vulnerability inventory.
Track NFS server availability metrics; sudden restarts of nfsd on RDMA-enabled servers warrant investigation.
Alert on new or unexpected RDMA connections to NFS servers from outside authorized storage networks.

How to Mitigate CVE-2026-89530

Immediate Actions Required

Apply the upstream Linux kernel fixes referenced in commits 0fbe20d, 1949dd1, 8ec60eb, and fcd91b9.
Restrict RDMA network reachability to trusted storage clients using segmentation, subnet ACLs, or InfiniBand partition keys.
Audit NFS server exports and disable RDMA transport where it is not operationally required.

Patch Information

The fix renames svc_rdma_pull_up_needed() to svc_rdma_check_pull_up() and changes its return contract from a boolean to a tri-state result reporting pull-up, no pull-up, or -E2BIG. When the reply cannot fit sc_max_req_size, the request is failed with ERR_CHUNK as directed by RFC 8166 Section 4.5.3 rather than corrupting the buffer or dropping the connection. Distribution vendors are shipping backports through their standard stable kernel channels.

Workarounds

Disable the NFS-over-RDMA listener by removing the rdma port entry from /proc/fs/nfsd/portlist or omitting the rdma option from the NFS server configuration until patches are applied.
Isolate RDMA-capable NFS servers on dedicated management networks unreachable from untrusted clients.
Prefer TCP transport for NFS in mixed environments where RDMA is not a hard performance requirement.

bash

# Disable RPC-over-RDMA listener on an NFS server as a temporary mitigation
echo "-rdma 20049" > /proc/fs/nfsd/portlist
systemctl restart nfs-server

# Verify no RDMA port is listening for nfsd
cat /proc/fs/nfsd/portlist | grep -i rdma