Look up another CVE · open CVE-2026-89528 in the interactive tracker

CVE-2026-89528

svcrdma: Reject Read lists that exceed the page budget

7.5 EPSS 0.7% AV:N

Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem net/sunrpc. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-89528 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	vulnerable	6.1.190-1	No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication.
Debian 13trixie	vulnerable	6.12.113-1	No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication.
Debian 14forky	fixed	7.2.6-1	Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.2.6-1	Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed because len reaches zero. A subsequent segment then accesses the NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping. Accumulate pages across all Read segments and reject the message at decode time when the total would overflow the page budget.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/sunrpc/xprtrdma/svc_rdma_recvfrom.c

What this is: KERNEL NFSD, SUNRPC, AND LOCKD SERVERSMAINTAINERS section matched on net/sunrpc/ · linux-nfs@vger.kernel.org · Supported
Kernel module: rpcrdma

Check it on the machine

grep -wE 'CONFIG_SUNRPC|CONFIG_SUNRPC_XPRT_RDMA' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w rpcrdma

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switches: CONFIG_SUNRPC, CONFIG_SUNRPC_XPRT_RDMA
Reads as: all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-09-11 (37 days ago)source
CVSS: 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.66%, higher than 50.4% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: net/sunrpc

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.13	6.18.51	1a3af2262cb3
4.13	7.2.4	465f511f59a0
4.13	7.3	0ca487abb3bd

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: svcrdma is nfsd's RPC-over-RDMA server transport; a remote peer reaches svc_rdma_recvfrom() by sending a Call with a Read list on an enabled NFS/RDMA listener over routable RoCEv2 or iWARP.
AC:LAttack complexity, low: The attacker fully controls Read-segment lengths in the transport header and can deterministically fill rq_pages exactly, then send a further segment so the len==0 overrun guard is skipped and the NULL sentinel is DMA-mapped, with no race or uncontrollable layout.
PR:NPrivileges required, none: xdr_count_read_segments() and svc_rdma_build_read_segment() run in svc_rdma_recvfrom() while assembling the transport message, before svc_process() performs RPC or NFS authentication, and RDMA CM accept has no credential check.
UI:NUser interaction, none: Sending a crafted RPC-over-RDMA message with an over-budget Read list is sufficient; no victim mount, click, or other user action is required.
S:UScope, unchanged: The NULL dereference oops stays in the host kernel that owns nfsd/svcrdma; this is not a VM, IOMMU, or sandbox escape.
C:NConfidentiality impact, none: The fault is a NULL pointer dereference of the rq_pages[rq_maxpages] sentinel during DMA mapping; the access faults immediately and does not disclose kernel memory.
I:NIntegrity impact, none: The sentinel slot is a guaranteed NULL page pointer, not an out-of-bounds page used as a write destination; DMA mapping aborts on the NULL page without an arbitrary-write or control-flow hijack primitive.
A:HAvailability impact, high: DMA mapping the NULL sentinel produces a kernel oops or panic that an unauthenticated NFS/RDMA peer can trigger repeatedly.