CVE-2026-72129

CVE CVE-2026-72129EUVD EUVD-2026-58887Published 2026-08-15T05:53:05.000ZLast changed 2026-08-17T05:40:41.000ZCVSS 9.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 5.15.212; patch: 6.1.178; 4.19; 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <7c96581169c9d9a7d0726e554313acfbead6141c; patch: 5.10.261; patch: 6.6.145; 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <bf8bcc1c137d54a62a428b00051fdbb13660673b; patch: 6.12.97; 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <2944113ad5fbcdf5d349d857c03d2a44b6de75b8; 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <11401371152b228448a41d79c6de1c938f93049a; patch: 7.1.5; 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <48c0162f647bb47e6084ffbc71b8f213f5e2f4f8; patch: 0; patch: 7.2; 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <42a8ea3acd883f4f210d9e54e0975b1e2292b529; patch: 6.18.40; 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <98bcdfa619150b2f41fa15bac140dbaf2584ad05; 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <c2106ba1b14d644a5203bea1a50dbe25dcad713c

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.