In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed because len reaches zero. A subsequent segment then accesses the NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping. Accumulate pages across all Read segments and reject the message at decode time when the total would overflow the page budget.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed
    the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a
    requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When
    one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed
    because len reaches zero. A subsequent segment then accesses the NULL sentinel slot at
    rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping. Accumulate pages across
    all Read segments and reject the message at decode time when the total would overflow the page budget.
    (CVE-2026-89528)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at     decode time, but nothing prevents a requester from sending multiple segments whose cumulative length     exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in     svc_rdma_build_read_segment() is bypassed because len reaches zero. A subsequent segment then accesses the     NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping.
    Accumulate pages across all Read segments and reject the message at decode time when the total would     overflow the page budget. (CVE-2026-89528)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
372022	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:22167-1)	Nessus	SuSE Local Security Checks	Local	high
475412	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Cloud Security	Google COS Security Checks	Local	high
475412	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
345075	Linux Distros Unpatched Vulnerability : CVE-2026-89528	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-89528

high

Tenable Plugins

high

high

high

high