CVE-2026-89530
A vulnerability in the Linux kernel's RPC-over-RDMA implementation allows a remote client to cause a buffer overflow by requesting an oversized reply. This can corrupt adjacent memory and potentially lead to a denial of service or more severe impact. The issue has been fixed by rejecting oversized replies with an appropriate error.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernels that include the vulnerable svcrdma code, typically those used in environments supporting RPC-over-RDMA (e.g., NFS over RDMA).
Real-world impact
An attacker could exploit this to crash the kernel or potentially achieve code execution, leading to a compromise of the entire system.
Why this severity
The CVSS base score of 9.8 (critical) indicates this vulnerability is easy to exploit and can lead to complete loss of confidentiality, integrity, and availability.
What to do about it
- 01Determine your current Linux kernel version.
- 02Check your distribution's security advisories or the Linux kernel repository for a patch addressing CVE-2026-89530.
- 03Install the updated kernel package that includes the fix.
- 04Reboot your system to apply the new kernel.
NVD description includes fix details
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.