CVE-2026-93228

A flaw was found in the Linux kernel's Remote Procedure Call over Remote Direct Memory Access (RPC-over-RDMA) server component (svcrdma). A remote peer can exploit this issue by transmitting a malformed Write or Reply chunk with a segment count of zero. Because the kernel fails to validate that the segment count is greater than zero, it accepts and links degenerate chunk structures onto internal processing lists. This flaw may result in unexpected memory traversal or a Denial of Service (DoS).

A flaw of moderate impact was found in the Linux kernel's Remote Procedure Call over Remote Direct Memory Access (RPC-over-RDMA) server component (svcrdma) as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The XDR chunk validation (xdr_check_write_chunk()) only rejected segment counts above the allowed maximum, so a Write or Reply chunk with a segment count of zero passed the range check, and a degenerate zero-segment chunk structure was linked onto the server's internal parsed chunk lists. A remote peer able to send requests to the svcrdma transport could transmit such a malformed chunk, which could lead to unexpected memory traversal or a denial of service of the affected kernel. Confidentiality and integrity are not affected; the impact is limited to availability.

Red Hat Enterprise Linux 6 is out of support scope, and Red Hat Enterprise Linux 7 (kernel and kernel-rt) as well as the Red Hat Enterprise Linux 8.4 z-stream are not affected because the vulnerable code is not present in those kernels. The affected Red Hat Enterprise Linux 8, 9, and 10 update streams (including kernel-rt) and Red Hat In-Vehicle OS 2 are affected, and fixes are being pursued through the delegated update streams.

The CVE.org record scores this flaw 9.1 (Critical) using a network attack vector with high confidentiality and availability impact, whereas Red Hat scores it 5.5 (Moderate) with no confidentiality or integrity impact, reflecting Red Hat's assessment of the limited security impact on the affected kernel.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.