CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 0.5%
EPSS score, percentile 42.9 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 9.1 Critical
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- 5.11
Unaffected before 5.11; 5.15.221; 6.1.188; 6.6.157; 6.12.109; 6.18.50; and 2 more
Source: CISA KEV 2026.10.29, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
What to do
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | from 78147ca8b4a9 to before 1e2e3481e391 |
| Affected | from 78147ca8b4a9 to before 3a78b841879c |
| Affected | from 78147ca8b4a9 to before 06d0390c37fa |
| Affected | from 78147ca8b4a9 to before 9c5a03c3dc50 |
| Affected | from 78147ca8b4a9 to before a1c954ca4977 |
| Affected | from 78147ca8b4a9 to before 6d33a7e6bf6c |
| Affected | from 78147ca8b4a9 to before b7713a784c59 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | 5.11 |
| Unaffected | before 5.11 |
| Unaffected | 5.15.221 |
| Unaffected | 6.1.188 |
| Unaffected | 6.6.157 |
| Unaffected | 6.12.109 |
| Unaffected | 6.18.50 |
| Unaffected | 7.2.4 |
| Unaffected | 7.3 |
Versions not listed are: affected.
Versions the record lists as unaffected: 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3.
Source: CVE List, as of . About the data.
About this vulnerability
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pcl_for_each_segment for empty chunks When a parsed chunk list contains a chunk whose ch_segcount is zero, pcl_for_each_segment computes its inclusive upper bound as &chunk->ch_segments[ch_segcount - 1]. ch_segcount is u32, so the subtraction wraps to 0xFFFFFFFF and the bound lands far past the ch_segments flex arr…
Summary: CVE record, as of .
- CISA has not added CVE-2026-89532 to its Known Exploited Vulnerabilities (KEV) catalog, as of 29 Oct 2026.
- The CVE record was published on 11 Sep 2026.
- The CVE record carries a CVSS v3.1 base score of 9.1 (Critical), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.5% (percentile 42.9), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
- CISA's SSVC assessment in the CVE record: exploitation none, automatable yes, technical impact partial.
Source: CISA KEV 2026.10.29, as of ; CVE List, as of ; FIRST EPSS, as of . About the data.
Description
svcrdma: Fix pcl_for_each_segment for empty chunks
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pcl_for_each_segment for empty chunks When a parsed chunk list contains a chunk whose ch_segcount is zero, pcl_for_each_segment computes its inclusive upper bound as &chunk->ch_segments[ch_segcount - 1]. ch_segcount is u32, so the subtraction wraps to 0xFFFFFFFF and the bound lands far past the ch_segments flex array. The loop body then walks unrelated memory at sizeof(struct svc_rdma_segment) stride until it faults. A zero-segcount chunk is reachable from the wire: xdr_check_write_chunk() only rejects segcount values greater than rc_maxpages, and pcl_alloc_write() links a freshly allocated chunk onto rc_write_pcl/rc_reply_pcl before its segment-fill loop runs, so a Write or Reply chunk advertising zero segments leaves ch_segcount == 0 on the list. When the transport has negotiated Send-With-Invalidate, svc_rdma_get_inv_rkey() iterates all four PCLs with pcl_for_each_segment and dereferences segment->rs_handle on each iteration, turning the underflow into an out-of-bounds read and a general protection fault. xdr_check_write_list / xdr_check_reply_chunk pcl_alloc_write() chunk = pcl_alloc_chunk(...) /* ch_segcount = 0 */ list_add_tail(&chunk->ch_list, &pcl->cl_chunks) /* fill loop iterates zero times for wire segcount 0 */ svc_rdma_get_inv_rkey() pcl_for_each_chunk(rc_write_pcl) pcl_for_each_segment(segment, chunk) pos <= &ch_segments[0u - 1u] /* 0xFFFFFFFF */ segment->rs_handle /* OOB read -> GPF */ Fix by switching the macro to a half-open upper bound that uses ch_segcount directly. For ch_segcount == 0 the loop start equals the loop end and the body is skipped; for ch_segcount > 0 the iteration range is unchanged. All six existing call sites in net/sunrpc/xprtrdma/svc_rdma_recvfrom.c and net/sunrpc/xprtrdma/svc_rdma_rw.c remain correct under the new bound, so no caller changes are needed.
Source: CVE List, as of . About the data.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
7
Known exploited Linux vulnerabilities
- CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
- CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- CVE-2025-39964: Linux Kernel Race Condition Vulnerability
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2026-53362: Linux Kernel Unspecified Vulnerability