EUVD-2026-76434
GHSA-4rjj-pgm8-m2r9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
svcrdma decode path is reached before NFS authentication, so PR:N; crash impact is availability-only with no confidentiality or integrity effect.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Reject Read lists that exceed the page budget
Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed because len reaches zero. A subsequent segment then accesses the NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping.
Accumulate pages across all Read segments and reject the message at decode time when the total would overflow the page budget.
AnalysisAI
NULL pointer dereference in the Linux kernel svcrdma subsystem (NFS over RDMA) allows unauthenticated remote clients to crash the kernel by sending a crafted RDMA Read list whose cumulative segment lengths overflow the rq_pages page array. The vulnerability bypasses per-segment length validation by exploiting an edge case where a single segment fills the page array exactly, causing the loop guard to exit prematurely; a subsequent segment then dereferences the NULL sentinel slot at rq_pages[rq_maxpages] during DMA mapping, triggering a kernel panic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The server must have the svc_rdma kernel module loaded and an NFS export actively serving over an RDMA-capable transport (InfiniBand, RoCE, or iWARP). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the DoS-only character of this flaw: an unauthenticated network peer can crash the kernel, but no code execution or data exfiltration primitive is described. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched kernel release: 6.18.51, 7.2.4, or 7.3-rc1 contain the decode-time fix that accumulates page counts across all Read segments and rejects messages whose total would overflow the page budget. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all systems running Linux kernel NFS-over-RDMA (svcrdma subsystem) via configuration review and network scanning; obtain the applicable kernel patch version from your Linux vendor's security advisory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today