CVE-2026-13087

Summary

A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire multi-page reply into a fixed-size 4096-byte heap buffer without bounds checking, resulting in a kernel heap overflow. This can lead to denial of service via kernel crash or potential code execution through corruption of adjacent kernel heap objects.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-787: Out-of-bounds Write

Workarounds

This vulnerability requires the NFS/RDMA server to be running with CONFIG_SUNRPC_XPRT_RDMA enabled, which requires RDMA hardware (InfiniBand or RoCE). Systems that do not have RDMA hardware or do not export NFS over RDMA are not affected. If NFS/RDMA is not required, disabling or not loading the svcrdma kernel module prevents exploitation.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: total

Additional References

References