CVE-2026-89530

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

DEBIAN-CVE-2026-89526

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

CVE-2026-89529

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdrcountreadsegments checks 4-byte alignment for non-zero position values but does not...

CVE-2026-89526

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

AZL-100851 CVE-2026-89530 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

AZL-100728 CVE-2026-89526 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

UBUNTU-CVE-2026-89529

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdrcountreadsegments checks 4-byte alignment for non-zero position values but does not...

CVE-2026-89526

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

UBUNTU-CVE-2026-89533

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

UBUNTU-CVE-2026-89526

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

UBUNTU-CVE-2026-89530

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

CVE-2026-89529

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdrcountreadsegments checks 4-byte alignment for non-zero position values but does not...

CVE-2026-89530

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

CVE-2026-89691

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

CVE-2026-89708

CVE-2026-89708 is a use-after-free race condition in the Linux kernel's NFS daemon (nfsd) . During NFSv4 session teardown (DESTROY_SESSION), the session memory can be freed via kfree() while an in-flight callback rpc_task on rpciod still dereferences clp->cl_cb_session. The workqueue flush in ...

CVE-2026-89532 svcrdma: Fix pcl_for_each_segment for empty chunks

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pclforeachsegment for empty chunks When a parsed chunk list contains a chunk whose chsegcount is zero, pclforeachsegment computes its inclusive upper bound as &chunk-chsegmentschsegcount - 1. chsegcount is u32, so th...

CVE-2026-89530

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

CVE-2026-89530 svcrdma: Reject inline replies that overflow the pull-up buffer

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

EUVD-2026-76436

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

CVE-2026-89530 svcrdma: Reject inline replies that overflow the pull-up buffer

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...