CVE-2026-89532
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A vulnerability exists in the Linux kernel's svcrdma component related to the pcl_for_each_segment macro. When a parsed chunk list contains a chunk with ch_segcount equal to zero, the inclusive upper bound calculation underflows, causing the loop to walk past the ch_segments flex array and resulting in an out-of-bounds read and a general protection fault. The issue is reachable from the wire via a Write or Reply chunk advertising zero segments when the transport has negotiated Send-With-Invalidate.
Risk Assessment
The vulnerability can be triggered remotely by an attacker to cause a kernel crash (denial of service) on an NFS/SunRPC server using RDMA. It may also lead to disclosure of kernel memory contents through the out-of-bounds read.
Recommendation
Update the Linux kernel to a version containing the fix that switches the pcl_for_each_segment macro to a half-open upper bound using ch_segcount directly. Until patched, consider restricting access to RDMA/NFS services from untrusted networks.
Other vulnerabilities in Linux kernel
See all- CVE-2026-99269Unknown
In the Linux kernel sched_ext scheduler, a task can be found on a non-local DSQ while the CPU that dispatched it is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING. The DSQ consume and move paths don't wait for dispatch to finish and can operate on the task concurrently with the dispatcher. The fix adds scx_wait_dispatching() before operating on the task.
- CVE-2026-99268Unknown
In io_uring with IORING_SETUP_DEFER_TASKRUN, completions are queued as local work and only become CQEs when the submitter enters the kernel to wait for events. io_uring_poll() reports EPOLLIN if local work is pending, but only if the work exists at call time; after DEFER_TASKRUN was added, the ->poll_wq wakeup was replaced by directly waking the submitter, so poll() can sleep despite pending work. The fix wakes ->poll_wq when the first entry is put on the work list, using an RCU callback when needed.
- CVE-2026-99267Unknown
In io_uring NAPI with dynamic tracking, a NAPI id not seen for a minute should be dropped from the ring's busy-poll list. However, the timeout is computed incorrectly — SEC_CONVERSION is used instead of the number of jiffies per second, giving about eight years for HZ=1000 and overflowing on 32-bit systems. As a result, entries are never removed and every wait polls all historical ids.
- CVE-2026-99266Unknown
In io_uring zcrx, io_zcrx_queue_cqe() computes the buffer offset in its area from net_iov_idx(), which is an unsigned int, so the shift is done in 32 bits and only the result is widened to the u64 placed in the CQE. An area can be up to 1 TB, so for every niov beyond the first 4 GB the CQE points the application at a buffer 4 GB (or a multiple) below the correct one. The application reads wrong data and returns a buffer it doesn't own via the refill queue while the real one is never given back.
- CVE-2026-99265Unknown
In io_uring/openclose, io_pipe_fixed() installs both ends of the pipe in the fixed file table, drops ->uring_lock, and copies the slot numbers to the application. If that faults, it takes the lock again and removes whatever is in these slots. If the request is run by io-wq, the lock really is dropped and the slots are visible to others; by the time the error path gets to them, they may have been closed and reused (by IORING_OP_CLOSE, direct open/accept, or IORING_REGISTER_FILES_UPDATE), causing removal of a file unrelated to the failed request. The fix performs the copy with the lock held.
- CVE-2026-99264Unknown
A bug was fixed in the Linux kernel's io_uring/net handling of recv retries on uncommitted buffers. When a receive was retried after a partial transfer, the kernel could hand out buffer memory that the retried request was still writing to, causing data overwrites. The request is now completed with the bytes received instead of retried, and MSG_WAITALL is no longer honoured for incremental buffers or multi-buffer bundles.
- CVE-2026-99263Unknown
In io_uring/poll, if a wakeup sets IO_POLL_RETRY_FLAG between the owning task consuming the existing instance of IO_POLL_RETRY_FLAG and the loop check in io_poll_check_events(), request processing stalls until an unrelated wakeup arrives. The fix uses atomic_cmpxchg instead of atomic_sub_return to guarantee both the count v and poll_refs are 0 and no wakeups are missed.
- CVE-2026-99262Unknown
In io_uring/timeout, an IORING_OP_TIMEOUT run by io-wq due to IOSQE_ASYNC has the same problem as poll, futex, and waitid. io_wq_submit_work() checks IO_WQ_WORK_CANCEL only once before issuing the request; a cancel in between flags the work, gets -EALREADY, and searches ->timeout_list in vain while the worker adds the request and starts the timer. Nobody checks the flag again and the timeout runs its course, and at ring exit a task can get stuck for the full duration. The fix checks the flag under ->timeout_lock and fails the request if set.
- CVE-2026-99261Unknown
In the drm/amdgpu driver, reservation fence slot allocation for eviction of userq per-vm BOs has been corrected. The fix addresses both the move overflow and the eviction fence add for these buffers.
- CVE-2026-99260Unknown
In the NTFS filesystem, ntfs_new_attr_flags skipped the resident-to-non-resident conversion when setting sparse/compressed flags on a resident attribute and terminated. The fix corrects this conversion.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pcl_for_each_segment for empty chunks When a parsed chunk list contains a chunk whose ch_segcount is zero, pcl_for_each_segment computes its inclusive upper bound as &chunk->ch_segments[ch_segcount - 1]. ch_segcount is u32, so the subtraction wraps to 0xFFFFFFFF and the bound lands far past the ch_segments flex array. The loop body then walks unrelated memory at sizeof(struct svc_rdma_segment) stride until it faults. A zero-segcount chunk is reachable from the wire: xdr_check_write_chunk() only rejects segcount values greater than rc_maxpages, and pcl_alloc_write() links a freshly allocated chunk onto rc_write_pcl/rc_reply_pcl before its segment-fill loop runs, so a Write or Reply chunk advertising zero segments leaves ch_segcount == 0 on the list. When the transport has negotiated Send-With-Invalidate, svc_rdma_get_inv_rkey() iterates all four PCLs with pcl_for_each_segment and dereferences segment->rs_handle on each iteration, turning the underflow into an out-of-bounds read and a general protection fault. xdr_check_write_list / xdr_check_reply_chunk pcl_alloc_write() chunk = pcl_alloc_chunk(...) /* ch_segcount = 0 */ list_add_tail(&chunk->ch_list, &pcl->cl_chunks) /* fill loop iterates zero times for wire segcount 0 */ svc_rdma_get_inv_rkey() pcl_for_each_chunk(rc_write_pcl) pcl_for_each_segment(segment, chunk) pos <= &ch_segments[0u - 1u] /* 0xFFFFFFFF */ segment->rs_handle /* OOB read -> GPF */ Fix by switching the macro to a half-open upper bound that uses ch_segcount directly. For ch_segcount == 0 the loop start equals the loop end and the body is skipped; for ch_segcount > 0 the iteration range is unchanged. All six existing call sites in net/sunrpc/xprtrdma/svc_rdma_recvfrom.c and net/sunrpc/xprtrdma/svc_rdma_rw.c remain correct under the new bound, so no caller changes are needed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS