# CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction

> A remote attacker can trigger integer underflows in the Linux kernel's RPC/RDMA module to expose adjacent memory or execute code.

- **Severity:** Critical 9.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 11 Sep 2026
- **Updated:** 21 Oct 2026
- **Also known as:** AZL-100728, BELL-CVE-2026-89526, DEBIAN-CVE-2026-89526, GHSA-jj8v-vrfx-wp8w, UBUNTU-CVE-2026-89526

## What is CVE-2026-89526?

CVE-2026-89526 is a critical memory corruption vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Validate Read chunk positions before reconstruction

The RPC/RDMA Read chunk position field is supplied by the remote
client and stored verbatim in the parsed chunk list.
xdr_count_read_segments() checks only 4-byte alignment; it never
compares the position against the received inline body length.

In the single-chunk path, svc_rdma_read_complete_one() splits the
head and tail kvecs at ch_position. A position past the inline
body underflows the tail length, exposing adjacent slab memory to
the upper XDR decoder.

In the multi-chunk path, svc_rdma_read_multiple_chunks() computes
gap lengths between chunks as unsigned subtractions from
ch_position. Overlapping Read chunks cause these subtractions to
underflow. A final position past the inline body likewise
underflows the trailing gap length. svc_rdma_copy_inline_range()
then copies past the receive buffer into request pages that are
returned to the client through the Reply channel.

Bound inline-range copies in svc_rdma_copy_inline_range() against
the decoded inline RPC body saved in rc_saved_arg. Reject a
single Read chunk positioned beyond that body, and reject
multi-chunk lists where accumulated read bytes exceed the next
chunk's position. Apply the same position and overlap checks in
the call-chunk interleaving path.

## Which versions are affected by CVE-2026-89526?


## How do I fix CVE-2026-89526?

Apply the vendor's patch.

## Is CVE-2026-89526 being exploited?

There is no known exploitation of CVE-2026-89526 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-89526 and fix it if it is affected.

What it is: CVE-2026-89526 is a critical memory corruption vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-89526 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-89526/ (Markdown: https://insights.sbomify.com/CVE-2026-89526/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-89526
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89526
- OSV: https://osv.dev/vulnerability/CVE-2026-89526

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-89526/
Summaries are generated and may contain mistakes; the official description above is the record.