CVE-2026-93228
Description
A flaw was found in the Linux kernel's Remote Procedure Call over Remote Direct Memory Access (RPC-over-RDMA) server component (svcrdma). A remote peer can exploit this issue by transmitting a malformed Write or Reply chunk with a segment count of zero. Because the kernel fails to validate that the segment count is greater than zero, it accepts and links degenerate chunk structures onto internal processing lists. This flaw may result in unexpected memory traversal or a Denial of Service (DoS).
Statement
A flaw of moderate impact was found in the Linux kernel's Remote Procedure Call over Remote Direct Memory Access (RPC-over-RDMA) server component (svcrdma) as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The XDR chunk validation (xdr_check_write_chunk()) only rejected segment counts above the allowed maximum, so a Write or Reply chunk with a segment count of zero passed the range check, and a degenerate zero-segment chunk structure was linked onto the server's internal parsed chunk lists. A remote peer able to send requests to the svcrdma transport could transmit such a malformed chunk, which could lead to unexpected memory traversal or a denial of service of the affected kernel. Confidentiality and integrity are not affected; the impact is limited to availability.
Red Hat Enterprise Linux 6 is out of support scope, and Red Hat Enterprise Linux 7 (kernel and kernel-rt) as well as the Red Hat Enterprise Linux 8.4 z-stream are not affected because the vulnerable code is not present in those kernels. The affected Red Hat Enterprise Linux 8, 9, and 10 update streams (including kernel-rt) and Red Hat In-Vehicle OS 2 are affected, and fixes are being pursued through the delegated update streams.
The CVE.org record scores this flaw 9.1 (Critical) using a network attack vector with high confidentiality and availability impact, whereas Red Hat scores it 5.5 (Moderate) with no confidentiality or integrity impact, reflecting Red Hat's assessment of the limited security impact on the affected kernel.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 9.1 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Modify Memory; Read Memory
If a negative value is used to access memory, buffers, or other indexable structures, it could access memory outside the bounds of the buffer.
Availability
Technical Impact: DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
In some contexts, a negative value could lead to resource consumption, e.g., if the negative value is used for memory allocation.
Integrity,Confidentiality,Availability
Technical Impact: Modify Application Data; Execute Unauthorized Code or Commands
An attacker could modify the structure of the message or data being sent to the downstream component, possibly injecting commands.
Integrity
Technical Impact: Varies by Context; Unexpected State
The use of a negative number in a positive-only context could have security implications for other types of resources. For example, a shopping cart might check that the user is not requesting more than 10 items, but a request for -3 items could cause the application to calculate a negative price and credit the attacker's account.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
