CVE-2026-89533: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89533 Overview

CVE-2026-89533 is a Linux kernel vulnerability in the svcrdma (SUNRPC RDMA server) subsystem. The flaw resides in svc_rdma_read_chunk_range(), which walks a Read chunk's segment list to build a sub-range for a Position-Zero or Call chunk. Two arithmetic defects in the per-segment loop produce incorrect DMA lengths and a u32 integer underflow. A remote NFS/RDMA client can trigger a near-UINT_MAX length value that propagates into svc_rdma_build_read_segment() and forces a multi-megabyte kmalloc_array_node() allocation in svc_rdma_get_rw_ctxt().

Critical Impact
Remote unauthenticated attackers reaching an RDMA-enabled NFS server can trigger memory corruption and kernel resource exhaustion, with potential for denial of service or further exploitation.

Affected Products

Linux kernel with the SUNRPC RDMA server (svcrdma) module enabled
NFS-over-RDMA server deployments
Distributions shipping unpatched kernel branches referenced by the stable kernel commits

Discovery Timeline

2026-09-11 - CVE-2026-89533 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89533

Vulnerability Analysis

The vulnerability is an integer underflow rooted in incorrect boundary arithmetic inside svc_rdma_read_chunk_range(). The function iterates a Read chunk's segment list using pcl_for_each_segment() to assemble a sub-range starting at a caller-supplied byte offset for a specified length. Two distinct defects combine to produce corrupt DMA lengths and an unsigned underflow.

First, the skip predicate uses > instead of >=. When the running offset equals a segment's full rs_length, that segment is fully consumed and should be skipped. Instead, execution falls into the loop body, and dummy.rs_length is computed as min_t(u32, length, rs_length) - rs_length. When length is smaller than rs_length, this subtraction underflows to a value near UINT_MAX.

Second, the length formula subtracts offset from the min_t() result rather than capping the segment's actual residual (rs_length - offset). When length < rs_length - offset, the per-segment length becomes length - offset instead of length, silently dropping data.

Root Cause

The root cause is off-by-one boundary handling combined with misplaced arithmetic in a min_t(u32, ...) expression. Because rs_length is a u32, subtracting a larger value produces wraparound rather than a signed negative. The wrapped value flows to svc_rdma_build_read_segment(), which uses it to compute nr_bvec and drive kmalloc_array_node() inside svc_rdma_get_rw_ctxt(), producing multi-MiB allocations from attacker-influenced input.

Attack Vector

Exploitation requires network reachability to an RDMA-enabled NFS server. A malicious or malformed client can craft RPC requests whose Read chunk segment layout places the running offset exactly on a segment boundary, or whose Call chunk terminates exactly at the end of the last Read chunk producing a zero-length request. Either condition triggers the underflow path in the kernel-space RPC handler without authentication in typical NFS-over-RDMA deployments.

No verified public proof-of-concept is available. The vulnerability mechanism is documented in the upstream commit messages linked in the kernel Git tree.

Detection Methods for CVE-2026-89533

Indicators of Compromise

Unexpected large kmalloc_array_node() allocations originating from svc_rdma_get_rw_ctxt() in kernel logs or tracepoints.
Kernel warnings, OOM-killer activity, or allocator failures correlated with inbound NFS-over-RDMA traffic.
Sudden drops in RDMA transport availability or crashes in the svcrdma module.

Detection Strategies

Enable ftrace or perf on svc_rdma_read_chunk_range and svc_rdma_build_read_segment to observe abnormally large nr_bvec values.
Monitor dmesg for svcrdma allocation warnings and Read chunk parse errors after applying vendor patches that add sanity checks.
Alert on kernel slab allocator anomalies on hosts exporting NFS over RDMA.

Monitoring Recommendations

Baseline normal NFS/RDMA client behavior and flag clients issuing malformed Read or Call chunks.
Ingest kernel and RPC subsystem logs into a central analytics platform for correlation with network flow data.
Track kernel package versions across the fleet to identify hosts still running vulnerable svcrdma code.

How to Mitigate CVE-2026-89533

Immediate Actions Required

Apply the upstream kernel fix from the stable tree commits referenced by the CVE and reboot affected NFS servers.
Restrict network access to NFS-over-RDMA ports (typically port 20049) to trusted client subnets only.
Disable svcrdma on servers that do not require RDMA transport for NFS.

Patch Information

Fixes are distributed across the stable Linux kernel branches. See the following upstream commits: Kernel Git Commit 10873311, Kernel Git Commit 4493c96b, Kernel Git Commit 4a44c140, Kernel Git Commit 6ee4dc74, Kernel Git Commit a46b35f2, Kernel Git Commit addbf02d, and Kernel Git Commit cba8543c. The fix changes the skip predicate to >=, moves - offset inside min_t(), returns success for zero-length requests, and stops iteration once the requested range is consumed.

Workarounds

Unload the svcrdma kernel module on servers where RDMA transport is not required.
Enforce firewall rules to block untrusted access to NFS-over-RDMA listeners.
Migrate NFS clients to TCP transport until the kernel patch is deployed.

bash

# Configuration example: disable svcrdma transport on the NFS server
sudo rmmod svcrdma
echo 'blacklist svcrdma' | sudo tee /etc/modprobe.d/blacklist-svcrdma.conf
sudo systemctl restart nfs-server