CVE-2026-89526

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Validate Read chunk positions before reconstruction

The RPC/RDMA Read chunk position field is supplied by the remote

client and stored verbatim in the parsed chunk list.

xdrcountread_segments() checks only 4-byte alignment; it never

compares the position against the received inline body length.

In the single-chunk path, svcrdmareadcompleteone() splits the

head and tail kvecs at ch_position. A position past the inline

body underflows the tail length, exposing adjacent slab memory to

the upper XDR decoder.

In the multi-chunk path, svcrdmareadmultiplechunks() computes

gap lengths between chunks as unsigned subtractions from

ch_position. Overlapping Read chunks cause these subtractions to

underflow. A final position past the inline body likewise

underflows the trailing gap length. svcrdmacopyinlinerange()

then copies past the receive buffer into request pages that are

returned to the client through the Reply channel.

Bound inline-range copies in svcrdmacopyinlinerange() against

the decoded inline RPC body saved in rcsavedarg. Reject a

single Read chunk positioned beyond that body, and reject

multi-chunk lists where accumulated read bytes exceed the next

chunk's position. Apply the same position and overlap checks in

the call-chunk interleaving path.