{"id":"CVE-2026-89530","title":"svcrdma: Reject inline replies that overflow the pull-up buffer","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject inline replies that overflow the pull-up buffer\n\nAn RPC-over-RDMA client can request a reply, such as an NFS READ\npayload, without providing a Write lis…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Linux","product":"Linux","affected":["Linux >= e248aa7be86e8179f20ac0931774ecd746f3f5bf < 8068358f445a11296328ffa7c524701596814a17","Linux >= e248aa7be86e8179f20ac0931774ecd746f3f5bf < fcd91b9957462d398792201c239dffaeff1cc8b2","Linux >= e248aa7be86e8179f20ac0931774ecd746f3f5bf < 1949dd1576f7a8aa161b1330c6125df9d53046d5","Linux >= e248aa7be86e8179f20ac0931774ecd746f3f5bf < 8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf","Linux >= e248aa7be86e8179f20ac0931774ecd746f3f5bf < 0fbe20dfe74b783d255bf389a6ea77aa25dc7860","Linux 9b65b18f817d9ada2bf67351f24bdcce6789a0bb","Linux d564356e1919d1178568c19af410cfc1a9076663","Linux >= 4.19.22 < 4.20","Linux >= 4.20.9 < 4.21","Linux 5.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T19:23:07.762867Z"},"published":"2026-09-11","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:47:42.592Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89530","references":[{"url":"https://git.kernel.org/stable/c/8068358f445a11296328ffa7c524701596814a17"},{"url":"https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2"},{"url":"https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5"},{"url":"https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf"},{"url":"https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89530.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89530"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532218"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89530"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89530"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89530.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00457,"epssPercentile":0.39481,"scores":{"cna":9.8,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.474Z","slug":"CVE-2026-89530","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject inline replies that overflow the pull-up buffer\n\nAn RPC-over-RDMA client can request a reply, such as an NFS READ\npayload, without providing a Write list or a Reply chunk to carry\nit. When such a reply needs more scatter/gather entries than the\ndevice's Send Queue supports, svc_rdma_pull_up_needed() selects\npull-up and svc_rdma_pull_up_reply_msg() linearizes the whole\nreply into sctxt->sc_xprt_buf. That buffer is only sc_max_req_size\nbytes, while the reply on this path is bounded only by the client's\nrequest, so svc_rdma_xb_linearize() copies past the end of the\nbuffer and corrupts adjacent slab memory. The oversized length is\nthen stored in sc_sges[0].length and posted, so the device also\nreads beyond the mapped region.\n\nThe SGE-exhaustion branch is the only pull-up path that can exceed\nthe buffer: the threshold branch pulls up only replies smaller\nthan RPCRDMA_PULLUP_THRESH, and replies that fit the device's SGE\nbudget are sent directly without linearization. Make\nsvc_rdma_pull_up_needed() report -E2BIG when the reply it would\npull up cannot fit sc_max_req_size, and fail the request with\nERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping\nthe connection.\n\nThe helper no longer answers a simple yes/no question: it now\nreports pull-up, no pull-up, or -E2BIG for a reply too large to\nlinearize. Rename svc_rdma_pull_up_needed() to\nsvc_rdma_check_pull_up() so its name no longer implies a boolean\npredicate.\n\n## Affected\n\n- `Linux >= e248aa7be86e8179f20ac0931774ecd746f3f5bf < 8068358f445a11296328ffa7c524701596814a17`\n- `Linux >= e248aa7be86e8179f20ac0931774ecd746f3f5bf < fcd91b9957462d398792201c239dffaeff1cc8b2`\n- `Linux >= e248aa7be86e8179f20ac0931774ecd746f3f5bf < 1949dd1576f7a8aa161b1330c6125df9d53046d5`\n- `Linux >= e248aa7be86e8179f20ac0931774ecd746f3f5bf < 8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf`\n- `Linux >= e248aa7be86e8179f20ac0931774ecd746f3f5bf < 0fbe20dfe74b783d255bf389a6ea77aa25dc7860`\n- `Linux 9b65b18f817d9ada2bf67351f24bdcce6789a0bb`\n- `Linux d564356e1919d1178568c19af410cfc1a9076663`\n- `Linux >= 4.19.22 < 4.20`\n- `Linux >= 4.20.9 < 4.21`\n- `Linux 5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89530.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":223295,"id":"CVE-2026-89530","ts":1792180048651,"field":"cvss","old":"7","new":"9.8"},{"seq":223294,"id":"CVE-2026-89530","ts":1792180048651,"field":"severity","old":"high","new":"critical"},{"seq":206930,"id":"CVE-2026-89530","ts":1789749704427,"field":"cvss","old":"8.1","new":"7"},{"seq":203023,"id":"CVE-2026-89530","ts":1789403733387,"field":"cvss","old":"9.8","new":"8.1"},{"seq":203022,"id":"CVE-2026-89530","ts":1789403733387,"field":"severity","old":"critical","new":"high"},{"seq":197965,"id":"CVE-2026-89530","ts":1789384321178,"field":"cvss","old":"8.1","new":"9.8"},{"seq":197964,"id":"CVE-2026-89530","ts":1789384321178,"field":"severity","old":"high","new":"critical"},{"seq":183766,"id":"CVE-2026-89530","ts":1789356677296,"field":"cvss","old":"9.8","new":"8.1"},{"seq":183765,"id":"CVE-2026-89530","ts":1789356677296,"field":"severity","old":"critical","new":"high"},{"seq":153322,"id":"CVE-2026-89530","ts":1789285350040,"field":"cvss","old":null,"new":"9.8"},{"seq":153321,"id":"CVE-2026-89530","ts":1789285350040,"field":"severity","old":"none","new":"critical"},{"seq":147596,"id":"CVE-2026-89530","ts":1789270211532,"field":"cvss","old":null,"new":"8.1"},{"seq":147595,"id":"CVE-2026-89530","ts":1789270211532,"field":"severity","old":"none","new":"high"},{"seq":109348,"id":"CVE-2026-89530","ts":1789183731559,"field":"cvss","old":null,"new":"8.1"},{"seq":109347,"id":"CVE-2026-89530","ts":1789183731559,"field":"severity","old":"none","new":"high"}]}