CVE-2026-89529
kernel: svcrdma: Reject oversized Read segments at decode time
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 11, 2026
Updated · October 8, 2026
Description
A flaw was found in the Linux kernel's svcrdma component, which handles Remote Procedure Call over Remote Direct Memory Access (RPC/RDMA) Read operations. This vulnerability occurs because the Read list decoder does not properly validate the lengths of incoming data segments. An attacker could send an oversized Read segment, leading to excessive memory allocation and a subsequent resource leak. This resource exhaustion could potentially result in a Denial of Service (DoS) condition, making the system unavailable.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 · Missing Release of Resource after Effective Lifetime