CVE-2026-89526

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Validate Read chunk positions before reconstruction

The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdr count read segments() checks only 4-byte alignment; it never compares the position against the received inline body length.

In the single-chunk path, svc rdma read complete one() splits the head and tail kvecs at ch position. A position past the inline body underflows the tail length, exposing adjacent slab memory to the upper XDR decoder.

In the multi-chunk path, svc rdma read multiple chunks() computes gap lengths between chunks as unsigned subtractions from ch position. Overlapping Read chunks cause these subtractions to underflow. A final position past the inline body likewise underflows the trailing gap length. svc rdma copy inline range() then copies past the receive buffer into request pages that are returned to the client through the Reply channel.

Bound inline-range copies in svc rdma copy inline range() against the decoded inline RPC body saved in rc saved arg. Reject a single Read chunk positioned beyond that body, and reject multi-chunk lists where accumulated read bytes exceed the next chunk's position. Apply the same position and overlap checks in the call-chunk interleaving path.