CVE-2026-72129

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the nvmet-rdma component where the nvmet rdma use inline sg() function incorrectly maps host-controlled inline data offsets. When a port is configured with an inline data size greater than PAGE SIZE, providing an offset within the range of PAGE SIZE to inline data size causes an underflow in the length calculation. This results in the sg->length being set to approximately 4 GiB, leading the block backend to read memory far beyond the first inline page. Additionally, the num pages(len) function ignores the offset, which can cause an under-count of the scatterlist when the data span crosses a page boundary. This can further lead to the nvmet req free sgls() function incorrectly freeing an inline page if the identity test in nvmet rdma release rsp() is not generalized to a range test.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.