DEBIAN-CVE-2026-72129

In the Linux kernel, the following vulnerability has been resolved:  nvmet-rdma: handle inline data with a nonzero offset  nvmetrdmauseinlinesg() maps the host-controlled inline data offset into the per-command inline scatterlist.  The bounds check admits any offset with off + len <= inlinedatasize, but the mapping still assumes the data begins in the first inline page:   sg->offset = off; sg->length = mint(int, len, PAGESIZE - off);  When a port is configured with inlinedatasize > PAGESIZE (settable up to max(SZ16K, PAGESIZE)), an offset in (PAGESIZE, inlinedatasize] makes "PAGESIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page.  numpages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist.  Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from pageoff + len.  Because the request scatterlist may now start at inlinesg[pageidx] rather than inlinesg[0], generalize the inline-SGL identity test in nvmetrdmareleasersp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmetreqfreesgls() frees an inline page (and warns in freelargekmalloc()).