CVE-2026-89532

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the svcrdma component where the pcl for each segment macro incorrectly calculates the upper bound when a parsed chunk list contains a chunk with a ch segcount of zero. Because ch segcount is an unsigned 32-bit integer, subtracting one results in an integer underflow to 0xFFFFFFFF, causing the loop to read memory far beyond the ch segments array. This condition can be triggered remotely via Write or Reply chunks advertising zero segments. When Send-With-Invalidate is negotiated, the svc rdma get inv rkey() function iterates through the lists and dereferences segment->rs handle, leading to an out-of-bounds read and a general protection fault (a system crash caused by accessing restricted memory).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.