CVE-2026-89532

A flaw was found in the Linux kernel's svcrdma component. A remote attacker could send a specially crafted network packet that causes an integer underflow in the pcl_for_each_segment function when processing a chunk with zero segments. This vulnerability leads to an out-of-bounds read, resulting in a general protection fault and a denial of service.

An out-of-bounds read in the SUNRPC svc RDMA parsed chunk list can occur when a remote peer supplies a Write or Reply chunk with zero segments. The pcl_for_each_segment macro computes an inclusive upper bound using ch_segcount minus 1, so a zero value underflows and makes the loop walk beyond the ch_segments flexible array. When Send-With-Invalidate is negotiated, svc_rdma_get_inv_rkey can iterate this malformed chunk and read segment metadata from unrelated memory until the kernel faults. For the CVSS the PR:N is used because no local account or target side privilege is required beyond network reachability to the RPC/RDMA service. The issue is network adjacent rather than broadly Internet reachable in typical deployments because RPC/RDMA is usually used inside trusted storage or data center networks. Impact is at least denial of service via kernel crash. For the paranoid score, limited confidentiality impact is retained because the primitive is an out-of-bounds kernel read, but no arbitrary write or clear privilege escalation path is shown.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.