CVE-2026-89526

A flaw was found in the svcrdma component of the Linux kernel. A remote attacker can exploit this vulnerability by supplying a crafted RPC/RDMA Read chunk position field that is not properly validated against the received inline body length. This can lead to an underflow, exposing adjacent slab memory or allowing data to be copied past the receive buffer into request pages. The most significant impact is information disclosure, potentially leading to memory corruption.

This flaw is evaluated as having an Important severity impact for Red Hat Enterprise Linux because a remote, authenticated client communicating with an RPC-over-RDMA listener can trigger out-of-bounds kernel memory reads, leading to leakage of confidential slab data or a kernel panic. Exposure is limited to environments where kernel-level RPC services, such as NFS, are explicitly configured to operate across InfiniBand or RoCE fabrics using the RPC-over-RDMA server transport. Standard network deployments utilizing conventional TCP or UDP transports do not invoke the vulnerable code path and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the svcrdma kernel module from being loaded by creating a configuration file in /etc/modprobe.d/:

1. Run the following command as root:

echo "install svcrdma /bin/true" > /etc/modprobe.d/disable-svcrdma.conf

2. If the module is currently loaded, unload it from memory:

modprobe -r svcrdma

Warning: Attempting to unload the module while it is actively handling connections can disrupt active services. If the module cannot be safely unloaded at runtime, a system restart will be required to apply the changes.

Caveats: Disabling the svcrdma module prevents the system from serving NFS or RPC traffic over RDMA transports. Standard NFS over TCP or UDP network interfaces is unaffected.