Linux Kernel EUVD-2026-86233

Requires a Linux NFS server configured with the RDMA transport (svcrdma) exporting over an RDMA fabric such as InfiniBand, RoCE, or iWARP - the vulnerable xdr_check_write_chunk()/pcl_alloc_write() path is only reachable in that configuration, which is not a default. The attacker must be positioned as an RDMA peer/client able to send Write or Reply chunks to the server (RFC 8166 RPC-over-RDMA), effectively requiring access to the RDMA network fabric. Exploitation is limited by: (1) the rarity of NFS-over-RDMA deployments; (2) the fact that an earlier patch in the same series already made pcl_for_each_segment() safe for ch_segcount==0, substantially reducing real impact on those trees; and (3) the need for RDMA-fabric reachability rather than arbitrary internet routing.

The input assigns CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), which on its face reads as a critical, remotely-exploitable, unauthenticated flaw. However, multiple signals argue for materially lower real-world risk. First, the vulnerability lives in svcrdma - the NFS-over-RDMA server transport - which is only present when a Linux NFS server is configured to export over an RDMA fabric (InfiniBand/RoCE/iWARP); this is a niche deployment, not a default. Second, and most important, the description explicitly states the dangerous behavior was ALREADY neutralized by an earlier patch in the same series that made pcl_for_each_segment() safe for ch_segcount==0, so this specific commit is framed by the author as 'defense in depth' that keeps degenerate zero-segment chunks off the parsed lists - meaning the headline C:H/A:H impact largely reflects the pre-hardening memory-walk risk rather than what this change alone remediates. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or automatable exploitation. Note a mild conflict between the CVSS impact (C:H confidentiality) and the code narrative (defense-in-depth against a memory walk that no longer occurs), suggesting the score may overstate current risk; verify the exact reachable impact against the specific tree/version in use. Bottom line: high nominal CVSS but low practical priority except for the narrow population running NFS/RDMA servers exposed to untrusted RDMA peers.

An attacker able to act as an RDMA peer to a Linux NFS-over-RDMA server sends a crafted Write or Reply chunk whose segcount field is zero, which slips past xdr_check_write_chunk()'s range check and gets linked onto rc_write_pcl/rc_reply_pcl as a zero-segment chunk. On kernels lacking the earlier pcl_for_each_segment() hardening this degenerate chunk could drive an out-of-bounds memory walk leading to disclosure or a server crash; on patched-series kernels the impact is largely contained, and no public exploit is identified at time of analysis.