{"id":"CVE-2026-89529","summary":"svcrdma: Reject oversized Read segments at decode time","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject oversized Read segments at decode time\n\nThe RPC/RDMA Read list decoder stores wire-supplied segment\nlengths without validation. xdr_count_read_segments() checks\n4-byte alignment for non-zero position values but does not\ncap the segment length.\n\nAn oversized rs_length reaches svc_rdma_build_read_segment(),\nwhich derives nr_bvec from it and can drive a large dynamic\nbvec allocation before verifying that enough rq_pages remain.\nIf the post-allocation page-overrun guard fires, the freshly\nacquired rw context is not returned, leaking the resource.\n\nReject any segment whose length exceeds the receive context's\npage budget during Read list decoding, consistent with how\nxdr_check_write_chunk() bounds Write segment counts against\nrc_maxpages. Also return the rw context on the existing\npost-allocation overrun path in svc_rdma_build_read_segment(),\nkeeping that defensive guard balanced.","modified":"2026-09-13T03:47:19.131748984Z","published":"2026-09-11T19:44:09.259Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89529.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/5120fe54e0e2f5b62797a432115cc61d61117a5b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/af6f0e06bed818ee7fc8b869915964410020a1c5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89529.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89529"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5ee62b4a91137557ee4b09d1604f1dfd0b4344a8"},{"fixed":"5120fe54e0e2f5b62797a432115cc61d61117a5b"},{"fixed":"af6f0e06bed818ee7fc8b869915964410020a1c5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89529.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89529.json"}}],"schema_version":"1.9.0"}