CVE-2026-89532
A critical bug in the Linux kernel’s RDMA service allowed attackers to trigger a crash by sending a specially crafted message with zero segments. The bug caused an out‑of‑bounds read and a general protection fault. The issue has been fixed by correcting the loop bounds in the kernel code.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, specifically the svcrdma component used by RDMA services. Any system running a kernel version before the patch that includes this fix is affected. Typical users are system administrators and developers deploying RDMA‑enabled services.
Real-world impact
An attacker could cause a denial of service by sending a crafted RDMA message that triggers a kernel crash, potentially leading to a reboot or service interruption.
Why this severity
The CVSS score of 9.1 reflects the high impact of the vulnerability: it can be exploited remotely without authentication, requires no user interaction, and results in a complete loss of availability (kernel crash).
What to do about it
- 01Upgrade your Linux kernel to a version that includes the fix for CVE-2026-89532.
NVD description indicates the vulnerability has been resolved.
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.