---
id: CVE-2026-72129
title: 'nvmet-rdma: handle inline data with a nonzero offset'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvmet-rdma: handle inline data with a nonzero offset

  nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset
  into the per-command inline scatterlist.  T…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <
    c2106ba1b14d644a5203bea1a50dbe25dcad713c
  - >-
    Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <
    bf8bcc1c137d54a62a428b00051fdbb13660673b
  - >-
    Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <
    11401371152b228448a41d79c6de1c938f93049a
  - >-
    Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <
    7c96581169c9d9a7d0726e554313acfbead6141c
  - >-
    Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <
    42a8ea3acd883f4f210d9e54e0975b1e2292b529
  - >-
    Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <
    2944113ad5fbcdf5d349d857c03d2a44b6de75b8
  - >-
    Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <
    98bcdfa619150b2f41fa15bac140dbaf2584ad05
  - >-
    Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <
    48c0162f647bb47e6084ffbc71b8f213f5e2f4f8
  - Linux 4.19
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T18:42:24.250750Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:44:58.318Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72129'
references:
  - url: 'https://git.kernel.org/stable/c/c2106ba1b14d644a5203bea1a50dbe25dcad713c'
  - url: 'https://git.kernel.org/stable/c/bf8bcc1c137d54a62a428b00051fdbb13660673b'
  - url: 'https://git.kernel.org/stable/c/11401371152b228448a41d79c6de1c938f93049a'
  - url: 'https://git.kernel.org/stable/c/7c96581169c9d9a7d0726e554313acfbead6141c'
  - url: 'https://git.kernel.org/stable/c/42a8ea3acd883f4f210d9e54e0975b1e2292b529'
  - url: 'https://git.kernel.org/stable/c/2944113ad5fbcdf5d349d857c03d2a44b6de75b8'
  - url: 'https://git.kernel.org/stable/c/98bcdfa619150b2f41fa15bac140dbaf2584ad05'
  - url: 'https://git.kernel.org/stable/c/48c0162f647bb47e6084ffbc71b8f213f5e2f4f8'
tags:
  - cve.org
epss: 0.00714
epssPercentile: 0.52733
ingestedAt: '2026-10-16T19:46:24.428Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvmet-rdma: handle inline data with a nonzero offset

nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset
into the per-command inline scatterlist.  The bounds check admits any
offset with off + len <= inline_data_size, but the mapping still assumes
the data begins in the first inline page:

	sg->offset = off;
	sg->length = min_t(int, len, PAGE_SIZE - off);

When a port is configured with inline_data_size > PAGE_SIZE (settable up
to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size]
makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and
the block backend reads far past the first inline page.  num_pages(len)
also ignores the offset, so an in-bounds offset whose [off, off+len)
span crosses a page boundary under-counts the scatterlist.

Map the offset properly: split it into a page index and an in-page
offset, start the scatterlist at that page, and size the page count from
page_off + len.  Because the request scatterlist may now start at
inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL
identity test in nvmet_rdma_release_rsp() to a range test; otherwise the
persistent inline scatterlist is mistaken for an allocated one and
nvmet_req_free_sgls() frees an inline page (and warns in
free_large_kmalloc()).

## Affected

- `Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < c2106ba1b14d644a5203bea1a50dbe25dcad713c`
- `Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < bf8bcc1c137d54a62a428b00051fdbb13660673b`
- `Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < 11401371152b228448a41d79c6de1c938f93049a`
- `Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < 7c96581169c9d9a7d0726e554313acfbead6141c`
- `Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < 42a8ea3acd883f4f210d9e54e0975b1e2292b529`
- `Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < 2944113ad5fbcdf5d349d857c03d2a44b6de75b8`
- `Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < 98bcdfa619150b2f41fa15bac140dbaf2584ad05`
- `Linux >= 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 < 48c0162f647bb47e6084ffbc71b8f213f5e2f4f8`
- `Linux 4.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.