Linux Kernel CVE-2026-89528

The server must have the svc_rdma kernel module loaded and an NFS export actively serving over an RDMA-capable transport (InfiniBand, RoCE, or iWARP). The attacker must have direct RDMA network access to the server - typically membership in the same InfiniBand fabric or converged Ethernet RDMA segment. The vulnerable decode path is reached before any NFS-layer authentication is applied, so no credentials are required to trigger the dereference. Standard TCP/IP or UDP NFS servers are entirely unaffected. The specialized hardware and network fabric requirement substantially limits the realistic attacker population compared to the PR:N/AV:N CVSS vector might imply in isolation.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the DoS-only character of this flaw: an unauthenticated network peer can crash the kernel, but no code execution or data exfiltration primitive is described. EPSS at 0.21% (11th percentile) indicates minimal current exploitation interest, and the absence of a CISA KEV entry confirms no confirmed in-the-wild attacks at time of analysis. The realistic threat surface is narrow - exploitation requires svcrdma to be running, which demands both InfiniBand or RoCE hardware and an active NFS-over-RDMA export - meaning even a mid-sized municipal IT team in tczew running standard Ethernet-based NFS would have no exposure. The attack itself is non-trivial at the protocol level, requiring a malformed RDMA Read list to reach the vulnerable decode path, though the commit description makes the triggering condition clear. Overall risk is moderate: high impact where svcrdma is present, but limited to specialized HPC and high-performance storage environments.

An attacker with RDMA network access to a server running NFS-over-RDMA crafts an RPC/RDMA Read list where the first segment's length exactly fills the server's rq_pages array and a second segment follows immediately. The server's svc_rdma_build_read_segment() exits its loop after the first segment without rejecting the message; DMA mapping of the second segment dereferences the NULL sentinel at rq_pages[rq_maxpages], triggering a kernel panic that crashes the host and drops all active NFS sessions. No public exploit code is known, but the triggering boundary condition is precisely described in the upstream commit.