# CVE-2026-89528

## Summary

- **CVE ID:** CVE-2026-89528
- **Severity:** HIGH
- **CVSS Score:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 13, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Reject Read lists that exceed the page budget

Individual Read segment lengths are validated at decode time, but
nothing prevents a requester from sending multiple segments whose
cumulative length exceeds the rq_pages array budget. When one
segment fills the page array exactly, the runtime guard in
svc_rdma_build_read_segment() is bypassed because len reaches zero.
A subsequent segment then accesses the NULL sentinel slot at
rq_pages[rq_maxpages], resulting in a NULL pointer dereference during
DMA mapping.

Accumulate pages across all Read segments and reject the message at
decode time when the total would overflow the page budget.

## Affected Products

- Linux — Linux (026d958b38c628a1b4ced534808945365e2747a5)
- Linux — Linux (4.13)
- Linux — Linux (0)
- Linux — Linux (6.18.51)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)

## References

- [CNA](https://git.kernel.org/stable/c/1a3af2262cb384112ef38632de4690682be528b4)
- [CNA](https://git.kernel.org/stable/c/465f511f59a0fa7a80d5d1073c4b24f28ea38f58)
- [CNA](https://git.kernel.org/stable/c/0ca487abb3bdf581851664b5db21f364caf57682)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.63%
- **EPSS Percentile:** 48.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._