CVE-2026-89533

A flaw was found in the svcrdma component of the Linux kernel. Incorrect offset arithmetic in the svc_rdma_read_chunk_range() function can lead to a u32 underflow. This underflow can cause the system to attempt to allocate a large amount of memory, potentially resulting in a Denial of Service (DoS) due to excessive memory consumption.

An arithmetic bug in svcrdma Read chunk range handling can calculate an incorrect DMA segment length when the requested offset reaches or lies inside a segment. In the boundary case the u32 length can underflow and propagate into a very large nr_bvec value, causing oversized kernel allocations in the RPC over RDMA server path. A remote RDMA client on a reachable NFS/RDMA transport can trigger this by sending crafted Read chunk layout and offset values. For the CVSS the PR:N is used because no local account on the target is required when the attacker can connect as an RDMA client to the exposed service. The issue is best modeled as adjacent network reachable because NFS/RDMA is normally deployed on local storage or data center fabrics rather than the public Internet. Impact is denial of service through memory pressure or kernel allocation failure. No concrete arbitrary write or information leak primitive is shown by the code context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.