CVE-2026-89529

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Reject oversized Read segments at decode time

The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdr count read segments() checks 4-byte alignment for non-zero position values but does not cap the segment length.

An oversized rs length reaches svc rdma build read segment(), which derives nr bvec from it and can drive a large dynamic bvec allocation before verifying that enough rq pages remain. If the post-allocation page-overrun guard fires, the freshly acquired rw context is not returned, leaking the resource.

Reject any segment whose length exceeds the receive context's page budget during Read list decoding, consistent with how xdr check write chunk() bounds Write segment counts against rc maxpages. Also return the rw context on the existing post-allocation overrun path in svc rdma build read segment(), keeping that defensive guard balanced.