CVE-2026-72129
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In the Linux kernel, the nvmet-rdma module has an issue with handling inline data with a nonzero offset. The function nvmet_rdma_use_inline_sg() maps the host-controlled offset but assumes the data begins in the first inline page. For offsets larger than the page size, a length underflow can occur, leading to out-of-bounds reads.
Risk Assessment
The vulnerability can lead to out-of-bounds memory reads, potentially exposing sensitive data or causing a system crash.
Recommendation
Apply the patch from the Linux kernel update that correctly maps the offset to a page index and in-page offset, and properly calculates the number of pages.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).