EUVD-2026-76436

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

CVE-2026-89530 svcrdma: Reject inline replies that overflow the pull-up buffer

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

CVE-2026-89530

CVE-2026-89530 affects the Linux kernel's svcrdma component, which implements RPC-over-RDMA for NFS. When a client requests a reply (e.g., an NFS READ payload) without providing a Write list or Reply chunk, and the reply exceeds the device's scatter/gather entry budget, the pull-up path linearize...

CVE-2026-89530

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

EUVD-2026-76435

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdrcountreadsegments checks 4-byte alignment for non-zero position values but does not...

CVE-2026-89529

CVE-2026-89529 affects the svcrdma (NFS/RDMA server) subsystem in the Linux kernel . The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation: xdr_count_read_segments() checks 4-byte alignment but does not cap the segment length. An oversized rs_length reaches svc_rd...

CVE-2026-89529 svcrdma: Reject oversized Read segments at decode time

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdrcountreadsegments checks 4-byte alignment for non-zero position values but does not...

CVE-2026-89529 svcrdma: Reject oversized Read segments at decode time

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdrcountreadsegments checks 4-byte alignment for non-zero position values but does not...

CVE-2026-89529

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdrcountreadsegments checks 4-byte alignment for non-zero position values but does not...

CVE-2026-89528

CVE-2026-89528 affects the Linux kernel's svcrdma (RPC-over-RDMA) server. Individual Read segment lengths are validated at decode time, but nothing prevents a remote requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page...

EUVD-2026-76432

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

CVE-2026-89526

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

CVE-2026-89526

A vulnerability in the Linux kernel's svcrdma (NFS/RDMA server) component allows a remote attacker to craft an RPC/RDMA Read chunk position field that bypasses validation. In the single-chunk path, a position past the inline body underflows the tail length, exposing adjacent slab memory to the up...

CVE-2026-89526 svcrdma: Validate Read chunk positions before reconstruction

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

CVE-2026-89526 svcrdma: Validate Read chunk positions before reconstruction

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

CVE-2026-89510

CVE-2026-89510 is a use-after-free vulnerability in the Linux kernel's RDMA/cxgb4 (Chelsio) driver. When c4iw_remove() frees the device context (ctx->dev) while the reg_work work item—queued by c4iw_uld_state_change()—is still pending or executing, c4iw_register_device() may access already-fre...

CVE-2026-89510 RDMA/cxgb4: Cancel reg_work before freeing device on remove

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

CVE-2026-89509

CVE-2026-89509 affects the Linux kernel 's RDMA/ionic driver . The root cause is that the ionic driver was merged without adapting to the rdma_zalloc_drv_obj() API introduced by commit 7e53b31acc7f, which requires drivers to embed struct rdma_counter in a driver-specific struct and register its s...

EUVD-2026-76415

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...

EUVD-2026-76416

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...