{
  "threat_severity" : "Important",
  "public_date" : "2026-08-15T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: nvmet-rdma: handle inline data with a nonzero offset",
    "id" : "2516731",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2516731"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-125",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nnvmet-rdma: handle inline data with a nonzero offset\nnvmet_rdma_use_inline_sg() maps the host-controlled inline data offset\ninto the per-command inline scatterlist.  The bounds check admits any\noffset with off + len <= inline_data_size, but the mapping still assumes\nthe data begins in the first inline page:\nsg->offset = off;\nsg->length = min_t(int, len, PAGE_SIZE - off);\nWhen a port is configured with inline_data_size > PAGE_SIZE (settable up\nto max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size]\nmakes \"PAGE_SIZE - off\" underflow, so sg->length is set to ~4 GiB and\nthe block backend reads far past the first inline page.  num_pages(len)\nalso ignores the offset, so an in-bounds offset whose [off, off+len)\nspan crosses a page boundary under-counts the scatterlist.\nMap the offset properly: split it into a page index and an in-page\noffset, start the scatterlist at that page, and size the page count from\npage_off + len.  Because the request scatterlist may now start at\ninline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL\nidentity test in nvmet_rdma_release_rsp() to a range test; otherwise the\npersistent inline scatterlist is mistaken for an allocated one and\nnvmet_req_free_sgls() frees an inline page (and warns in\nfree_large_kmalloc()).", "A flaw was found in the `nvmet-rdma` component of the Linux kernel. This vulnerability arises from incorrect handling of inline data with a non-zero offset, which can lead to an integer underflow. An attacker could exploit this to cause the system to read beyond its allocated memory, potentially resulting in an out-of-bounds read. This could lead to a denial of service or the disclosure of sensitive information." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-09-08T00:00:00Z",
    "advisory" : "RHSA-2026:65334",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.53.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-09-08T00:00:00Z",
    "advisory" : "RHSA-2026:64770",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.160.1.rt7.501.el8_10"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-72129\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72129\nhttps://lore.kernel.org/linux-cve-announce/2026081530-CVE-2026-72129-841e@gregkh/T" ],
  "name" : "CVE-2026-72129",
  "mitigation" : {
    "value" : "To mitigate this issue, prevent the `nvmet_rdma` kernel module from loading if NVMe over RDMA functionality is not required. This can be achieved by creating a modprobe configuration file.\n1. Create a file named `/etc/modprobe.d/disable-nvmet_rdma.conf` with the following content:\n```\ninstall nvmet_rdma /bin/true\n```\n2. Regenerate the initramfs to ensure the change takes effect on boot:\n```bash\ndracut -f -v\n```\n3. Reboot the system for the changes to be fully applied.\nThis mitigation may impact systems that rely on NVMe over RDMA for storage operations. If NVMe over RDMA is in use, consider configuring `inline_data_size` to be less than or equal to `PAGE_SIZE` if your workload permits, though this might affect performance.",
    "lang" : "en:us"
  },
  "csaw" : false
}