CVE-2026-13087

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A heap out-of-bounds write exists in the RPC-over-RDMA server reply path within net/sunrpc/xprtrdma/svc rdma sendto.c. The issue occurs when a crafted RPC-over-RDMA client sends a large NFS READ request containing an empty Write list and no Reply chunk. In this scenario, the server linearizes the multi-page reply into a fixed-size 4096-byte heap buffer without performing bounds checking, causing a kernel heap overflow. This may result in a denial of service through a kernel crash or potential code execution by corrupting adjacent kernel heap objects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.