DEBIAN-CVE-2026-89532

In the Linux kernel, the following vulnerability has been resolved:  svcrdma: Fix pclforeachsegment for empty chunks  When a parsed chunk list contains a chunk whose chsegcount is zero, pclforeachsegment computes its inclusive upper bound as &chunk->chsegments[chsegcount - 1]. chsegcount is u32, so the subtraction wraps to 0xFFFFFFFF and the bound lands far past the chsegments flex array. The loop body then walks unrelated memory at sizeof(struct svcrdmasegment) stride until it faults.  A zero-segcount chunk is reachable from the wire: xdrcheckwritechunk() only rejects segcount values greater than rcmaxpages, and pclallocwrite() links a freshly allocated chunk onto rcwritepcl/rcreplypcl before its segment-fill loop runs, so a Write or Reply chunk advertising zero segments leaves chsegcount == 0 on the list. When the transport has negotiated Send-With-Invalidate, svcrdmagetinvrkey() iterates all four PCLs with pclforeachsegment and dereferences segment->rshandle on each iteration, turning the underflow into an out-of-bounds read and a general protection fault.      xdrcheckwritelist / xdrcheckreplychunk       pclallocwrite()         chunk = pclallocchunk(...)  /* chsegcount = 0 /         listaddtail(&chunk->chlist, &pcl->clchunks)         / fill loop iterates zero times for wire segcount 0 /      svcrdmagetinvrkey()       pclforeachchunk(rcwritepcl)         pclforeachsegment(segment, chunk)           pos <= &chsegments[0u - 1u]  / 0xFFFFFFFF /           segment->rshandle            / OOB read -> GPF */  Fix by switching the macro to a half-open upper bound that uses chsegcount directly. For chsegcount == 0 the loop start equals the loop end and the body is skipped; for chsegcount > 0 the iteration range is unchanged. All six existing call sites in net/sunrpc/xprtrdma/svcrdmarecvfrom.c and net/sunrpc/xprtrdma/svcrdmarw.c remain correct under the new bound, so no caller changes are needed.