CVE-2026-89533 Linux CVE debrief

Who should care

Linux kernel developers and administrators responsible for maintaining and securing Linux-based systems. They should verify Linux kernel versions and apply patches to prevent potential DMA length issues. They should also review system configurations to prevent potential DMA length issues

Why it matters

A vulnerability in the Linux kernel's svc_rdma_read_chunk_range function can cause incorrect DMA lengths and a u32 underflow when processing Read chunks.

• Verify Linux kernel versions to ensure patch application
• Review system configurations to prevent potential DMA length issues

Technical summary

The svc_rdma_read_chunk_range function in the Linux kernel has two arithmetic defects that can cause incorrect DMA lengths and a u32 underflow when processing Read chunks. The defects are in the skip predicate and the length formula of the per-segment loop. The skip predicate uses '>' instead of '>=' and the length formula subtracts offset from the min_t() result rather than from segment->rs_length before the cap. This can cause a multi-MiB kmalloc_array_node() allocation. The vulnerability can be exploited by a remote attacker to cause a denial of service or potentially execute arbitrary code

Defensive priority

Verify Linux kernel versions and apply patches to prevent potential DMA length issues.

Recommended defensive actions

• Verify Linux kernel versions and apply patches to prevent potential DMA length issues
• Review system configurations to prevent potential DMA length issues
• Verify Linux kernel versions to ensure patch application
• Review system configurations and update as necessary
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify affected or patched versions. The Linux kernel's svc_rdma_read_chunk_range function has two arithmetic defects that can cause incorrect DMA lengths and a u32 underflow when processing Read chunks. The vulnerability is in the Linux kernel's RDMA (Remote Direct Memory Access) implementation. The CVE record was published on 2026-09-11T20:19:36.250Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, but

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.