CVE-2026-89532: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89532 Overview

CVE-2026-89532 is an out-of-bounds read vulnerability in the Linux kernel's svcrdma (SVC RDMA) transport, part of the SunRPC XPRT-RDMA subsystem. The flaw resides in the pcl_for_each_segment macro, which computes an inclusive upper bound as &chunk->ch_segments[ch_segcount - 1]. When ch_segcount is zero, the unsigned 32-bit subtraction wraps to 0xFFFFFFFF, causing the loop to walk unrelated memory at sizeof(struct svc_rdma_segment) stride until it triggers a general protection fault.

Remote attackers can reach this condition over the wire because xdr_check_write_chunk() does not reject chunks with a zero segment count.

Critical Impact
A remote unauthenticated attacker can send a crafted RDMA Write or Reply chunk to trigger an out-of-bounds read and general protection fault (GPF), causing kernel crash and denial of service on NFS-over-RDMA servers.

Affected Products

Linux kernel net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
Linux kernel net/sunrpc/xprtrdma/svc_rdma_rw.c
Linux systems exposing NFS-over-RDMA server (svcrdma) with Send-With-Invalidate negotiated

Discovery Timeline

2026-09-11 - CVE-2026-89532 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89532

Vulnerability Analysis

The vulnerability is an out-of-bounds read triggered by an integer underflow in the pcl_for_each_segment iteration macro within the Linux kernel's svcrdma transport. When a parsed chunk list contains a chunk whose ch_segcount field equals zero, the macro computes its inclusive upper bound as &chunk->ch_segments[ch_segcount - 1].

Because ch_segcount is a u32, the subtraction wraps to 0xFFFFFFFF. The loop body then dereferences segment pointers far past the ch_segments flex array, walking unrelated kernel memory at sizeof(struct svc_rdma_segment) stride until it faults.

When the RDMA transport has negotiated Send-With-Invalidate, svc_rdma_get_inv_rkey() iterates all four PCLs and dereferences segment->rs_handle on every iteration, converting the underflow into a kernel out-of-bounds read and a general protection fault.

Root Cause

The root cause is an integer underflow in unsigned arithmetic combined with insufficient input validation on wire-supplied values. xdr_check_write_chunk() only rejects segcount values greater than rc_maxpages, so a value of zero passes validation. pcl_alloc_write() then links a freshly allocated chunk onto rc_write_pcl or rc_reply_pcl before its segment-fill loop runs, leaving ch_segcount == 0 on the list for later consumers.

Attack Vector

A remote unauthenticated attacker with network access to an NFS-over-RDMA server can send a crafted RPC containing a Write or Reply chunk that advertises zero segments. When the kernel later invokes svc_rdma_get_inv_rkey() on the chunk list, the underflow triggers an out-of-bounds read that produces a general protection fault and kernel crash.

The vulnerability requires no authentication, no user interaction, and low attack complexity. Exploitation results in denial of service against the kernel RDMA transport.

The upstream fix converts pcl_for_each_segment to use a half-open upper bound driven directly by ch_segcount. For ch_segcount == 0, the loop start equals the loop end and the body is skipped. See the Linux Kernel Commit b7713a78 for the reference fix.

Detection Methods for CVE-2026-89532

Indicators of Compromise

Unexpected kernel general protection faults (GPF) referencing svc_rdma_get_inv_rkey, pcl_for_each_segment, or svc_rdma_recvfrom in dmesg or /var/log/kern.log.
Sudden termination or restart of the nfsd service on hosts serving NFS-over-RDMA.
Unusual RDMA connection resets or RPC transport errors from unknown remote peers.

Detection Strategies

Monitor kernel ring buffer for oops traces containing svcrdma symbols or general protection faults during RPC handling.
Inspect RDMA traffic patterns for RPC Write or Reply chunks advertising zero segment counts using packet capture on InfiniBand or RoCE fabrics.
Correlate NFS server crashes with concurrent inbound RDMA sessions from untrusted network segments.

Monitoring Recommendations

Enable persistent kernel crash dump collection (kdump) on NFS-over-RDMA servers to capture GPF traces for post-incident analysis.
Aggregate nfsd and RDMA subsystem logs into a centralized log platform for anomaly detection.
Track kernel version and patch status across all Linux hosts exposing RDMA services to identify unpatched systems.

How to Mitigate CVE-2026-89532

Immediate Actions Required

Apply the upstream Linux kernel patches that switch pcl_for_each_segment to a half-open upper bound.
Restrict network access to NFS-over-RDMA services to trusted hosts and management networks using firewall or fabric-level access controls.
Disable NFS-over-RDMA (rdma transport in /etc/nfs.conf) on servers that do not require it until patches are deployed.

Patch Information

The fix is available in stable Linux kernel trees via multiple commits. Reference the upstream commits: Linux Kernel Commit 06d0390c, Linux Kernel Commit 1e2e3481, Linux Kernel Commit 3a78b841, Linux Kernel Commit 6d33a7e6, Linux Kernel Commit 9c5a03c3, Linux Kernel Commit a1c954ca, and Linux Kernel Commit b7713a78. Consult your distribution vendor for backported packages.

Workarounds

Unload or blacklist the svcrdma kernel module on systems that do not require NFS-over-RDMA server functionality.
Configure NFS to use TCP transport only until the kernel patch is applied.
Segment RDMA fabrics from general-purpose networks to reduce exposure of the vulnerable code path to untrusted senders.

bash

# Disable RDMA transport for NFS server and restrict to TCP
# /etc/nfs.conf
[nfsd]
rdma=n

# Blacklist the svcrdma module until patched
echo "blacklist svcrdma" | sudo tee /etc/modprobe.d/blacklist-svcrdma.conf
sudo systemctl restart nfs-server