From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C002585983 for ; Fri, 11 Sep 2026 19:54:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156490; cv=none; b=epBq/5oWqWFFWqjem/K4v3vjQPlm9GwjwGD+ecYK1QREmFBkCtibKD4n2JuOa+LAJZJHqqiObwAjFB6u3sTtb/MW87aStXgmI3fJIsrp/RXoTe5jo6fRTzWDJd/0xzTUW8ZY0wX44u/Dn0UFQI1NRjnb/TV8xj38HrN9DyWFD7Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156490; c=relaxed/simple; bh=RAL0WWq0eBckNkEsacfPuTSW1oy80a967tVXwGFdZE8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=U/Rf7/chj5Wi4MpqBS7ejkesxer2GMXtgCVmy4ggi0ux+LX70w2Iv6NjTTlm0bMP8hfuWI6XMZhMe0mJoIwEfpjoHeDwfnqpsvIFO5ob+nvXh62NkjLDdcY5f23+XUwEyKWjRo489UsByI/CB56ps+j+vdtb2srhe4kF5iya3z8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GRBi7Blb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="GRBi7Blb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 129C31F00898; Fri, 11 Sep 2026 19:54:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789156485; bh=P348/bGkcqgv6Hj94L/qEqhIzZ9kloGktdFYMlPMVJc=; h=From:To:Cc:Subject:Date:Reply-To; b=GRBi7Blb9ZtRWAib/5F5HzIs1dVBGQPkxWW0qWuRYuC00D6s2JR4g8GYTrl5LKHjZ Mb7+YZ/JR8WeUuIgQZExI6CLno7tJeduM/V7cKzluwBgDB6V6+mD+1oZxh/raVuzan LFmmLsjb3rxg/O/gLAjWZbqkpsk/qadow0ObgH+o= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range Date: Fri, 11 Sep 2026 21:43:42 +0200 Message-ID: <2026091117-CVE-2026-89533-17d5@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4698; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=JVNjfEIBbDWUw14r6mSnpNRScKhlhuG0ZXg3laVsGm8=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLImNruGs3K7xd/N6R71qzmj//LxulSwdyBQ8wCX63V Q79u0msI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACaSn8wwP2pH6MUzlYrHOg0y a5peZ1w4dvk0P8M85YOb01yT27ha3vpVXBF+IMFstYcVAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read_chunk_range svc_rdma_read_chunk_range() walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic defects in the per-segment loop produce wrong DMA lengths and a u32 underflow: pcl_for_each_segment(segment, chunk) { if (offset > segment->rs_length) { offset -= segment->rs_length; continue; } dummy.rs_handle = segment->rs_handle; dummy.rs_length = min_t(u32, length, segment->rs_length) - offset; dummy.rs_offset = segment->rs_offset + offset; First, the skip predicate uses '>' instead of '>='. When offset equals the segment's full rs_length, the segment is fully consumed and should be skipped, but the loop falls through into the body. The resulting dummy.rs_length is min_t(u32, length, rs_length) - rs_length, which underflows to a near-UINT_MAX u32 when length is smaller than rs_length, or is zero otherwise. Second, the length formula subtracts offset from the min_t() result rather than from segment->rs_length before the cap. For offset > 0 the segment's residual is rs_length - offset, not rs_length, so the cap must be applied to the residual. With the current bracketing, whenever length is smaller than rs_length - offset the per-segment length becomes length - offset instead of length, silently dropping offset bytes from the rebuilt chunk. Combined with the boundary case above it also enables the u32 underflow path, which propagates a huge nr_bvec into svc_rdma_build_read_segment() and a multi-MiB kmalloc_array_node() in svc_rdma_get_rw_ctxt(). Additionally, svc_rdma_read_call_chunk() can invoke this function with length == 0 when the last Read chunk ends exactly at the end of the Call chunk. With the corrected >= predicate, every segment is skipped and the function returns the initial -EINVAL, rejecting a valid request. Return success immediately when length is zero. Also break out of the loop once length is fully consumed to avoid passing zero-length segments to svc_rdma_build_read_segment(). Fix by using '>=' so a fully-consumed segment is skipped, by moving '- offset' inside min_t() so the cap is applied to the segment's residual length, by returning success for zero-length requests, and by stopping iteration when the requested range has been consumed. The Linux kernel CVE team has assigned CVE-2026-89533 to this issue. Affected and fixed versions =========================== Issue introduced in 5.11 with commit d7cc73972661be4a02a1b09f1d9b3283c6c05154 and fixed in 6.12.109 with commit 6ee4dc7476b3abc92ec1d444533a559f33f59561 Issue introduced in 5.11 with commit d7cc73972661be4a02a1b09f1d9b3283c6c05154 and fixed in 6.18.50 with commit a46b35f213c2426f5d6a0458a8f7e873fc59cdfd Issue introduced in 5.11 with commit d7cc73972661be4a02a1b09f1d9b3283c6c05154 and fixed in 7.2.4 with commit 4493c96bbd0068fadf69cbae8d13426202e34cdc Issue introduced in 5.11 with commit d7cc73972661be4a02a1b09f1d9b3283c6c05154 and fixed in 7.3-rc1 with commit 4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89533 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/sunrpc/xprtrdma/svc_rdma_rw.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/6ee4dc7476b3abc92ec1d444533a559f33f59561 https://git.kernel.org/stable/c/a46b35f213c2426f5d6a0458a8f7e873fc59cdfd https://git.kernel.org/stable/c/4493c96bbd0068fadf69cbae8d13426202e34cdc https://git.kernel.org/stable/c/4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e