CVE-2026-89530

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access (RDMA). A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area, leading to memory corruption. This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code.

This vulnerability is rated with an Important severity because an unauthenticated client communicating with an RPC-over-RDMA service can trigger out-of-bounds slab memory corruption, leading to a kernel crash or privilege escalation. Red Hat Enterprise Linux does not enable NFS over RDMA by default; exposure requires RDMA-capable network hardware alongside an explicitly enabled RDMA transport listener. Standard NFS server deployments operating over traditional TCP or UDP connections remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.