PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89530 Linux CVE debrief

A vulnerability in the Linux kernel's svcrdma has been resolved. An RPC-over-RDMA client can request a reply without providing a Write list or a Reply chunk to carry it, potentially causing svc_rdma_xb_linearize() to copy past the end of the buffer and corrupt adjacent slab memory. The issue arises when svc_rdma_pull_up_needed() selects pull-up and svc_rdma_pull_up_reply_msg() linearizes the whole reply into sctxt->sc_xprt_buf. This buffer is only sc_max_req_size bytes, while the reply on this path is bounded only by the client's request. The oversized length is then stored in sc_sges[0].length and posted, so the device also reads beyond the mapped region. The SGE-exhaustion branch

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-09-11
Advisory published
2026-09-11
Advisory updated
2026-09-11

Who should care

Linux kernel administrators and security teams should assess exposure and verify patch deployment for svc_rdma_check_pull_up() fix. They should also monitor for potential RPC-over-RDMA client requests that could trigger the vulnerability and review compensating controls for exposed systems.

Why it matters

CVE-2026-89530 is a Linux kernel vulnerability that requires verification of patch deployment to prevent potential memory corruption and exploitation.

  • Potential memory corruption and adjacent slab memory access
  • Verification of patch deployment is necessary to prevent exploitation
  • Monitoring for potential RPC-over-RDMA client requests that could trigger the vulnerability

Technical summary

The Linux kernel's svcrdma has a vulnerability where an RPC-over-RDMA client can request a reply without providing a Write list or a Reply chunk, potentially causing memory corruption. A fix has been applied to reject inline replies that overflow the pull-up buffer. The fix involves renaming svc_rdma_pull_up_needed() to svc_rdma_check_pull_up() and reporting -E2BIG when the reply it would pull up cannot fit sc_max_req_size, and failing the request with ERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping the connection.

Defensive priority

Linux kernel administrators should assess exposure and verify patch deployment.

Recommended defensive actions

  • Assess exposure of Linux kernel deployments to CVE-2026-89530
  • Verify patch deployment for svc_rdma_check_pull_up() fix
  • Monitor for potential RPC-over-RDMA client requests that could trigger the vulnerability
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify versions, exploitation, impact, or remediation beyond the provided patch. Linux kernel administrators and security teams should assess exposure and verify patch deployment for svc_rdma_check_pull_up() fix. The helper no longer answers a simple yes/no question: it now reports pull-up, no pull-up, or -E2BIG for a reply too large to linearize.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89530 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89530

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89530 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89530

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.