CVE-2026-72129Critical· 9.8▾ MidnightIn the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. T…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.7%
In the Linux kernel, the following vulnerability has been resolved:
nvmet-rdma: handle inline data with a nonzero offset
nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page:
sg->offset = off;
sg->length = min_t(int, len, PAGE_SIZE - off);
When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist.
Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).
Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < c2106ba1b14d644a5203bea1a50dbe25dcad713cLinux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < bf8bcc1c137d54a62a428b00051fdbb13660673bLinux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < 11401371152b228448a41d79c6de1c938f93049aLinux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < 7c96581169c9d9a7d0726e554313acfbead6141cLinux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < 42a8ea3acd883f4f210d9e54e0975b1e2292b529Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < 2944113ad5fbcdf5d349d857c03d2a44b6de75b8Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < 98bcdfa619150b2f41fa15bac140dbaf2584ad05Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < 48c0162f647bb47e6084ffbc71b8f213f5e2f4f8Linux 4.19Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99092Noneriscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99089NoneASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99093Nonemm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99088Nonenet: openvswitch: validate transport header presence in set_ipv6_addr
CVE-2026-99094NoneBluetooth: btintel_pcie: fix TX descriptor bounds check
CVE-2026-99090Nonedrm/amdgpu: serialize vblank counter reads against GPU reset