CVE-2026-89533

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

UBUNTU-CVE-2026-89533

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

Linux Distros Unpatched Vulnerability : CVE-2026-89533

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanni...

CVE-2026-89533

A flaw was found in the svcrdma component of the Linux kernel. Incorrect offset arithmetic in the svcrdmareadchunkrange function can lead to a u32 underflow. This underflow can cause the system to attempt to allocate a large amount of memory, potentially resulting in a Denial of Service DoS due t...

CVE-2026-89533

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

DEBIAN-CVE-2026-89533

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

AZL-100614 CVE-2026-89533 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

DEBIAN-CVE-2026-89532

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pclforeachsegment for empty chunks When a parsed chunk list contains a chunk whose chsegcount is zero, pclforeachsegment computes its inclusive upper bound as &chunk-chsegmentschsegcount - 1. chsegcount is u32, so th...

EUVD-2026-76439

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

CVE-2026-89533 svcrdma: Fix offset arithmetic in read_chunk_range

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

CVE-2026-89533 svcrdma: Fix offset arithmetic in read_chunk_range

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

CVE-2026-89533

CVE-2026-89533 affects the svcrdma component of the Linux kernel. Two arithmetic defects in svc_rdma_read_chunk_range() produce wrong DMA lengths and a u32 underflow when walking a Read chunk's segment list. The underflow propagates a near-UINT_MAX value into svc_rdma_build_read_segment(), trigge...

CVE-2026-89533

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

EUVD-2026-76438

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pclforeachsegment for empty chunks When a parsed chunk list contains a chunk whose chsegcount is zero, pclforeachsegment computes its inclusive upper bound as &chunk-chsegmentschsegcount - 1. chsegcount is u32, so th...

CVE-2026-89532 svcrdma: Fix pcl_for_each_segment for empty chunks

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pclforeachsegment for empty chunks When a parsed chunk list contains a chunk whose chsegcount is zero, pclforeachsegment computes its inclusive upper bound as &chunk-chsegmentschsegcount - 1. chsegcount is u32, so th...

PT-2026-90249

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read chunk range svc rdma read chunk range walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmet...

UBUNTU-CVE-2026-80584

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qethsnmpcommand and qethl3arpquery allocate a buffer sized by a user-supplied length udatalen without checking a lower bound, then set udataoffset to a fixed...

CVE-2026-80584

CVE-2026-80584 is a heap buffer overflow in the Linux kernel's s390/qeth network driver, affecting the qeth_snmp_command() and qeth_l3_arp_query() ioctls. The root cause is an unsigned integer underflow: a user-supplied udata_len smaller than the fixed non-zero udata_offset causes the bounds-chec...

CVE-2026-80584 s390/qeth: validate user buffer length in SNMP and ARP query ioctls

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qethsnmpcommand and qethl3arpquery allocate a buffer sized by a user-supplied length udatalen without checking a lower bound, then set udataoffset to a fixed...