Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89533— svcrdma: Fix offset arithmetic in read_chunk_range

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于svc_rdma_read_chunk_range()处理Read chunk段列表时偏移算术错误，跳过条件使用'>'而非'>='，长度计算未对段残差取上限，导致u32下溢并传递超大nr_bvec，可能造成错误DMA长度和大规模内存分配。

CVSS 9.8 · Critical EPSS 0.51% · P42

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux d7cc73972661be4a02a1b09f1d9b3283c6c05154< 10873311f91db9454e2fadbf9866bc819e0646d9 affected
d7cc73972661be4a02a1b09f1d9b3283c6c05154< addbf02dfe3b25e7e38e03bbd4e2a6ed86a14be7 affected
d7cc73972661be4a02a1b09f1d9b3283c6c05154< cba8543c18cf42fd80fd63effb6df6ff4f7e73ce affected
d7cc73972661be4a02a1b09f1d9b3283c6c05154< 6ee4dc7476b3abc92ec1d444533a559f33f59561 affected
d7cc73972661be4a02a1b09f1d9b3283c6c05154< a46b35f213c2426f5d6a0458a8f7e873fc59cdfd affected
d7cc73972661be4a02a1b09f1d9b3283c6c05154< 4493c96bbd0068fadf69cbae8d13426202e34cdc affected
d7cc73972661be4a02a1b09f1d9b3283c6c05154< 4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e affected
5.11 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89533

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
svcrdma: Fix offset arithmetic in read_chunk_range
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read_chunk_range svc_rdma_read_chunk_range() walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic defects in the per-segment loop produce wrong DMA lengths and a u32 underflow: pcl_for_each_segment(segment, chunk) { if (offset > segment->rs_length) { offset -= segment->rs_length; continue; } dummy.rs_handle = segment->rs_handle; dummy.rs_length = min_t(u32, length, segment->rs_length) - offset; dummy.rs_offset = segment->rs_offset + offset; First, the skip predicate uses '>' instead of '>='. When offset equals the segment's full rs_length, the segment is fully consumed and should be skipped, but the loop falls through into the body. The resulting dummy.rs_length is min_t(u32, length, rs_length) - rs_length, which underflows to a near-UINT_MAX u32 when length is smaller than rs_length, or is zero otherwise. Second, the length formula subtracts offset from the min_t() result rather than from segment->rs_length before the cap. For offset > 0 the segment's residual is rs_length - offset, not rs_length, so the cap must be applied to the residual. With the current bracketing, whenever length is smaller than rs_length - offset the per-segment length becomes length - offset instead of length, silently dropping offset bytes from the rebuilt chunk. Combined with the boundary case above it also enables the u32 underflow path, which propagates a huge nr_bvec into svc_rdma_build_read_segment() and a multi-MiB kmalloc_array_node() in svc_rdma_get_rw_ctxt(). Additionally, svc_rdma_read_call_chunk() can invoke this function with length == 0 when the last Read chunk ends exactly at the end of the Call chunk. With the corrected >= predicate, every segment is skipped and the function returns the initial -EINVAL, rejecting a valid request. Return success immediately when length is zero. Also break out of the loop once length is fully consumed to avoid passing zero-length segments to svc_rdma_build_read_segment(). Fix by using '>=' so a fully-consumed segment is skipped, by moving '- offset' inside min_t() so the cap is applied to the segment's residual length, by returning success for zero-length requests, and by stopping iteration when the requested range has been consumed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于svc_rdma_read_chunk_range()处理Read chunk段列表时偏移算术错误，跳过条件使用'>'而非'>='，长度计算未对段残差取上限，导致u32下溢并传递超大nr_bvec，可能造成错误DMA长度和大规模内存分配。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux d7cc73972661be4a02a1b09f1d9b3283c6c05154 ~ 10873311f91db9454e2fadbf9866bc819e0646d9 -
Linux Linux 5.11 -

II. Public POCs for CVE-2026-89533

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89533

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-89533 (7)

Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total

CVE-2026-89688 9.8 CRITICAL nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
CVE-2026-89655 9.8 CRITICAL ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
CVE-2026-89658 9.8 CRITICAL NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
CVE-2026-89660 9.8 CRITICAL NFSD: Prevent client use-after-free during admin state revocation
CVE-2026-89659 9.8 CRITICAL NFSD: Prevent client use-after-free during delegation revoke
CVE-2026-89662 9.8 CRITICAL NFSD: Prevent lock owner use-after-free during client teardown
CVE-2026-89669 9.8 CRITICAL nfsd: initialize copy-notify stateid before publishing it
CVE-2026-89674 9.8 CRITICAL nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
CVE-2026-89675 9.8 CRITICAL nfsd: fix UAF in async copy cancel and shutdown
CVE-2026-89676 9.8 CRITICAL nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
CVE-2026-89677 9.8 CRITICAL nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()
CVE-2026-89681 9.8 CRITICAL nfsd: fix layout fence worker double-reference race
CVE-2026-89686 9.8 CRITICAL nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
CVE-2026-89703 9.8 CRITICAL nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
CVE-2026-89479 9.8 CRITICAL sctp: stop processing a packet once its association is deleted
CVE-2026-89478 9.8 CRITICAL sctp: drop a chunk if its transport was removed
CVE-2026-89702 9.8 CRITICAL nfsd: size fh_verify server sockaddr slot by xpt_locallen
CVE-2026-89482 9.8 CRITICAL nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
CVE-2026-89708 9.8 CRITICAL nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
CVE-2026-89712 9.8 CRITICAL NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

Showing top 20 of 431 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89533

No comments yet

Leave a comment