CVE-2026-89528

A flaw was found in the Linux kernel's svcrdma component. A remote attacker could send specially crafted Read lists that exceed the page budget. This can lead to a NULL pointer dereference during Direct Memory Access (DMA) mapping, potentially causing a system crash and a denial of service.

An RPC/RDMA Read list handling flaw in svcrdma can cause a NULL-pointer dereference because each Read segment length is checked individually but the cumulative length across all segments is not bounded by the receive page budget. A remote RDMA peer can send multiple Read segments whose total size exceeds the rq_pages array budget. When one segment exactly consumes the page array, the following segment reaches the rq_pages sentinel slot and the server later dereferences a NULL page pointer during DMA mapping, causing a kernel crash (DoS). For the CVSS the PR:N is selected because a peer only needs network reachability to the NFS/RDMA service and no local account on the victim is required. The issue is network reachable only on systems that expose the RPC/RDMA or NFS/RDMA service, typically on storage or data center RDMA networks rather than the public Internet. Impact is denial of service via kernel crash, with no grounded evidence of information disclosure or privilege escalation from this patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.