GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89533 (GCVE-0-2026-89533)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-14 12:00
VLAI
Title
svcrdma: Fix offset arithmetic in read_chunk_range
Summary
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read_chunk_range svc_rdma_read_chunk_range() walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic defects in the per-segment loop produce wrong DMA lengths and a u32 underflow: pcl_for_each_segment(segment, chunk) { if (offset > segment->rs_length) { offset -= segment->rs_length; continue; } dummy.rs_handle = segment->rs_handle; dummy.rs_length = min_t(u32, length, segment->rs_length) - offset; dummy.rs_offset = segment->rs_offset + offset; First, the skip predicate uses '>' instead of '>='. When offset equals the segment's full rs_length, the segment is fully consumed and should be skipped, but the loop falls through into the body. The resulting dummy.rs_length is min_t(u32, length, rs_length) - rs_length, which underflows to a near-UINT_MAX u32 when length is smaller than rs_length, or is zero otherwise. Second, the length formula subtracts offset from the min_t() result rather than from segment->rs_length before the cap. For offset > 0 the segment's residual is rs_length - offset, not rs_length, so the cap must be applied to the residual. With the current bracketing, whenever length is smaller than rs_length - offset the per-segment length becomes length - offset instead of length, silently dropping offset bytes from the rebuilt chunk. Combined with the boundary case above it also enables the u32 underflow path, which propagates a huge nr_bvec into svc_rdma_build_read_segment() and a multi-MiB kmalloc_array_node() in svc_rdma_get_rw_ctxt(). Additionally, svc_rdma_read_call_chunk() can invoke this function with length == 0 when the last Read chunk ends exactly at the end of the Call chunk. With the corrected >= predicate, every segment is skipped and the function returns the initial -EINVAL, rejecting a valid request. Return success immediately when length is zero. Also break out of the loop once length is fully consumed to avoid passing zero-length segments to svc_rdma_build_read_segment(). Fix by using '>=' so a fully-consumed segment is skipped, by moving '- offset' inside min_t() so the cap is applied to the segment's residual length, by returning success for zero-length requests, and by stopping iteration when the requested range has been consumed.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d7cc73972661be4a02a1b09f1d9b3283c6c05154 , < 10873311f91db9454e2fadbf9866bc819e0646d9 (git)
Affected: d7cc73972661be4a02a1b09f1d9b3283c6c05154 , < addbf02dfe3b25e7e38e03bbd4e2a6ed86a14be7 (git)
Affected: d7cc73972661be4a02a1b09f1d9b3283c6c05154 , < cba8543c18cf42fd80fd63effb6df6ff4f7e73ce (git)
Affected: d7cc73972661be4a02a1b09f1d9b3283c6c05154 , < 6ee4dc7476b3abc92ec1d444533a559f33f59561 (git)
Affected: d7cc73972661be4a02a1b09f1d9b3283c6c05154 , < a46b35f213c2426f5d6a0458a8f7e873fc59cdfd (git)
Affected: d7cc73972661be4a02a1b09f1d9b3283c6c05154 , < 4493c96bbd0068fadf69cbae8d13426202e34cdc (git)
Affected: d7cc73972661be4a02a1b09f1d9b3283c6c05154 , < 4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_rw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10873311f91db9454e2fadbf9866bc819e0646d9",
              "status": "affected",
              "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
              "versionType": "git"
            },
            {
              "lessThan": "addbf02dfe3b25e7e38e03bbd4e2a6ed86a14be7",
              "status": "affected",
              "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
              "versionType": "git"
            },
            {
              "lessThan": "cba8543c18cf42fd80fd63effb6df6ff4f7e73ce",
              "status": "affected",
              "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
              "versionType": "git"
            },
            {
              "lessThan": "6ee4dc7476b3abc92ec1d444533a559f33f59561",
              "status": "affected",
              "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
              "versionType": "git"
            },
            {
              "lessThan": "a46b35f213c2426f5d6a0458a8f7e873fc59cdfd",
              "status": "affected",
              "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
              "versionType": "git"
            },
            {
              "lessThan": "4493c96bbd0068fadf69cbae8d13426202e34cdc",
              "status": "affected",
              "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
              "versionType": "git"
            },
            {
              "lessThan": "4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e",
              "status": "affected",
              "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_rw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Fix offset arithmetic in read_chunk_range\n\nsvc_rdma_read_chunk_range() walks a Read chunk\u0027s segment list to\nbuild a sub-range starting at byte offset and spanning length bytes\nfor a Position-Zero or Call chunk. Two arithmetic defects in the\nper-segment loop produce wrong DMA lengths and a u32 underflow:\n\n    pcl_for_each_segment(segment, chunk) {\n            if (offset \u003e segment-\u003ers_length) {\n                    offset -= segment-\u003ers_length;\n                    continue;\n            }\n\n            dummy.rs_handle = segment-\u003ers_handle;\n            dummy.rs_length = min_t(u32, length,\n                                    segment-\u003ers_length) - offset;\n            dummy.rs_offset = segment-\u003ers_offset + offset;\n\nFirst, the skip predicate uses \u0027\u003e\u0027 instead of \u0027\u003e=\u0027. When offset\nequals the segment\u0027s full rs_length, the segment is fully consumed\nand should be skipped, but the loop falls through into the body.\nThe resulting dummy.rs_length is min_t(u32, length, rs_length) -\nrs_length, which underflows to a near-UINT_MAX u32 when length is\nsmaller than rs_length, or is zero otherwise.\n\nSecond, the length formula subtracts offset from the min_t() result\nrather than from segment-\u003ers_length before the cap. For offset \u003e 0\nthe segment\u0027s residual is rs_length - offset, not rs_length, so the\ncap must be applied to the residual. With the current bracketing,\nwhenever length is smaller than rs_length - offset the per-segment\nlength becomes length - offset instead of length, silently dropping\noffset bytes from the rebuilt chunk. Combined with the boundary\ncase above it also enables the u32 underflow path, which propagates\na huge nr_bvec into svc_rdma_build_read_segment() and a multi-MiB\nkmalloc_array_node() in svc_rdma_get_rw_ctxt().\n\nAdditionally, svc_rdma_read_call_chunk() can invoke this function\nwith length == 0 when the last Read chunk ends exactly at the end\nof the Call chunk. With the corrected \u003e= predicate, every segment\nis skipped and the function returns the initial -EINVAL, rejecting\na valid request. Return success immediately when length is zero.\nAlso break out of the loop once length is fully consumed to avoid\npassing zero-length segments to svc_rdma_build_read_segment().\n\nFix by using \u0027\u003e=\u0027 so a fully-consumed segment is skipped, by\nmoving \u0027- offset\u0027 inside min_t() so the cap is applied to the\nsegment\u0027s residual length, by returning success for zero-length\nrequests, and by stopping iteration when the requested range has\nbeen consumed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - svcrdma is nfsd\u0027s RPC-over-RDMA server transport; a remote peer reaches svc_rdma_read_chunk_range() by sending a Call with a Position-Zero/Call chunk and Read list over routable iWARP or RoCEv2, matching prior kernel CNA scores for this subsystem.\nAC:L - The attacker fully controls Call-chunk segment lengths and Read-chunk positions and can place a Read chunk on a segment boundary with a smaller remaining range so dummy.rs_length underflows a u32 deterministically, with no race or uncontrollable layout.\nPR:N - svc_rdma_process_read_list() runs in svc_rdma_recvfrom() while assembling the transport message, before svc_process() performs RPC or NFS authentication, and RDMA CM accept has no credential check.\nUI:N - Sending a crafted RPC-over-RDMA message with a malicious Call chunk and Read list to an already-listening NFS/RDMA service is sufficient; no victim mount, click, or other user action is required.\nS:U - The vulnerable NFS/RDMA service and affected kernel memory belong to the same host kernel security authority; this is not a VM, IOMMU, or sandbox escape.\nC:H - The underflowed length is added to rc_readbytes and, when Reads complete, svc_rdma_read_complete_pzrc() sets xdr_buf.page_len to a near-4GiB value, so XDR walks far past the rq_pages allocation and reads adjacent kernel heap as page pointers.\nI:H - XDR helpers such as xdr_buf_pages_zero() kmap and memset through that inflated page_len, writing via out-of-bounds page pointers taken from adjacent slab, a kernel integrity and control-flow hijack primitive.\nA:H - On the scatterlist path PAGE_ALIGN wrapping to 0 hits sg_alloc_table_chained(0) which BUG_ON(!nents) and panics; the huge page_len walk oopses on invalid pages, and an unauthenticated peer can repeat this per request."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:43.968Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10873311f91db9454e2fadbf9866bc819e0646d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/addbf02dfe3b25e7e38e03bbd4e2a6ed86a14be7"
        },
        {
          "url": "https://git.kernel.org/stable/c/cba8543c18cf42fd80fd63effb6df6ff4f7e73ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ee4dc7476b3abc92ec1d444533a559f33f59561"
        },
        {
          "url": "https://git.kernel.org/stable/c/a46b35f213c2426f5d6a0458a8f7e873fc59cdfd"
        },
        {
          "url": "https://git.kernel.org/stable/c/4493c96bbd0068fadf69cbae8d13426202e34cdc"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e"
        }
      ],
      "title": "svcrdma: Fix offset arithmetic in read_chunk_range",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89533",
    "datePublished": "2026-09-11T19:44:12.236Z",
    "dateReserved": "2026-09-11T19:38:34.720Z",
    "dateUpdated": "2026-09-14T12:00:43.968Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89533",
      "date": "2026-09-17",
      "epss": "0.00509",
      "percentile": "0.42256"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/svc_rdma_rw.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "10873311f91db9454e2fadbf9866bc819e0646d9",
                    "status": "affected",
                    "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "addbf02dfe3b25e7e38e03bbd4e2a6ed86a14be7",
                    "status": "affected",
                    "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cba8543c18cf42fd80fd63effb6df6ff4f7e73ce",
                    "status": "affected",
                    "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6ee4dc7476b3abc92ec1d444533a559f33f59561",
                    "status": "affected",
                    "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a46b35f213c2426f5d6a0458a8f7e873fc59cdfd",
                    "status": "affected",
                    "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4493c96bbd0068fadf69cbae8d13426202e34cdc",
                    "status": "affected",
                    "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e",
                    "status": "affected",
                    "version": "d7cc73972661be4a02a1b09f1d9b3283c6c05154",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/svc_rdma_rw.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.11"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Fix offset arithmetic in read_chunk_range\n\nsvc_rdma_read_chunk_range() walks a Read chunk\u0027s segment list to\nbuild a sub-range starting at byte offset and spanning length bytes\nfor a Position-Zero or Call chunk. Two arithmetic defects in the\nper-segment loop produce wrong DMA lengths and a u32 underflow:\n\n    pcl_for_each_segment(segment, chunk) {\n            if (offset \u003e segment-\u003ers_length) {\n                    offset -= segment-\u003ers_length;\n                    continue;\n            }\n\n            dummy.rs_handle = segment-\u003ers_handle;\n            dummy.rs_length = min_t(u32, length,\n                                    segment-\u003ers_length) - offset;\n            dummy.rs_offset = segment-\u003ers_offset + offset;\n\nFirst, the skip predicate uses \u0027\u003e\u0027 instead of \u0027\u003e=\u0027. When offset\nequals the segment\u0027s full rs_length, the segment is fully consumed\nand should be skipped, but the loop falls through into the body.\nThe resulting dummy.rs_length is min_t(u32, length, rs_length) -\nrs_length, which underflows to a near-UINT_MAX u32 when length is\nsmaller than rs_length, or is zero otherwise.\n\nSecond, the length formula subtracts offset from the min_t() result\nrather than from segment-\u003ers_length before the cap. For offset \u003e 0\nthe segment\u0027s residual is rs_length - offset, not rs_length, so the\ncap must be applied to the residual. With the current bracketing,\nwhenever length is smaller than rs_length - offset the per-segment\nlength becomes length - offset instead of length, silently dropping\noffset bytes from the rebuilt chunk. Combined with the boundary\ncase above it also enables the u32 underflow path, which propagates\na huge nr_bvec into svc_rdma_build_read_segment() and a multi-MiB\nkmalloc_array_node() in svc_rdma_get_rw_ctxt().\n\nAdditionally, svc_rdma_read_call_chunk() can invoke this function\nwith length == 0 when the last Read chunk ends exactly at the end\nof the Call chunk. With the corrected \u003e= predicate, every segment\nis skipped and the function returns the initial -EINVAL, rejecting\na valid request. Return success immediately when length is zero.\nAlso break out of the loop once length is fully consumed to avoid\npassing zero-length segments to svc_rdma_build_read_segment().\n\nFix by using \u0027\u003e=\u0027 so a fully-consumed segment is skipped, by\nmoving \u0027- offset\u0027 inside min_t() so the cap is applied to the\nsegment\u0027s residual length, by returning success for zero-length\nrequests, and by stopping iteration when the requested range has\nbeen consumed."
          }
        ],
        "id": "CVE-2026-89533",
        "lastModified": "2026-09-14T13:19:08.560",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:36.250",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/10873311f91db9454e2fadbf9866bc819e0646d9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4493c96bbd0068fadf69cbae8d13426202e34cdc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6ee4dc7476b3abc92ec1d444533a559f33f59561"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a46b35f213c2426f5d6a0458a8f7e873fc59cdfd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/addbf02dfe3b25e7e38e03bbd4e2a6ed86a14be7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cba8543c18cf42fd80fd63effb6df6ff4f7e73ce"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T18:58:30+00:00",
      "cve": "CVE-2026-89533",
      "id": "CVE-2026-89533",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: svcrdma: Fix offset arithmetic in read_chunk_range",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89533.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-17T16:43:21Z",
      "cve": "CVE-2026-89533",
      "id": "CVE-2026-89533",
      "initial_release_date": "2026-09-17T16:43:21Z",
      "product_status:known_affected": "210",
      "product_status:known_not_affected": "143",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89533",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89533.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.