CVE-2026-13087: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-13087 is a heap out-of-bounds write vulnerability in the Linux kernel's RPC-over-RDMA server reply path, specifically in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire multi-page reply into a fixed-size 4096-byte heap buffer (sc_xprt_buf) without bounds checking, resulting in a kernel heap overflow. The vulnerability affects the Linux kernel (kernel and kernel-rt) on Red Hat Enterprise Linux systems with CONFIG_SUNRPC_XPRT_RDMA and CONFIG_NFSD enabled; all currently supported stable kernels are likely affected. It was reported on May 11, 2026, and publicly disclosed on September 22, 2026, with a CVSS v3.1 base score of 8.8 (High) (Red Hat CVE, Red Hat Bugzilla, Github Advisory).

The root cause is classified as CWE-787 (Out-of-bounds Write). The vulnerability arises because svc_rdma_pull_up_needed() triggers linearization based solely on SGE count (pd_num_sges >= sc_max_send_sges) without validating whether the total reply size fits within the 4096-byte sc_xprt_buf buffer allocated by svc_rdma_send_ctxt_alloc(). When a client omits Write and Reply chunks on a large READ request, svc_rdma_result_payload() is a no-op (chunk is NULL), causing pcl_process_nonpayloads() to treat the entire multi-page reply as non-payload data. The linearizer svc_rdma_xb_linearize() then executes unchecked memcpy() calls, copying up to ~12 KB (or more) into the 4096-byte buffer, overflowing into adjacent kernel heap objects. Exploitation requires network access to an NFS/RDMA service (InfiniBand or RoCE fabric), valid NFS credentials (AUTH_SYS or Kerberos), and a crafted RPC-over-RDMA client — stock Linux NFS clients do not produce this malformed request pattern (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can result in a reliable kernel crash (denial of service) or, with a carefully crafted payload, arbitrary kernel code execution through corruption of adjacent kernel heap objects. Confidentiality, integrity, and availability are all rated High, as heap corruption can expose adjacent kernel memory contents, corrupt arbitrary kernel objects enabling privilege escalation, and reliably panic the NFS/RDMA server. The practical exposure is limited to high-performance computing, storage, and datacenter environments that deploy NFS over RDMA hardware (InfiniBand or RoCE), as RDMA hardware and explicit configuration are prerequisites (Red Hat CVE, Red Hat Bugzilla).

A proof-of-concept (PoC) with detailed reproduction steps is publicly available via the Red Hat Bugzilla report, including specific kernel configuration, NFS/RDMA setup, and crafted RPC-over-RDMA client parameters (Red Hat Bugzilla). The NVD SSVC assessment classifies exploitation status as "poc" and technical impact as "total". There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is 0.0, and the vulnerability is not currently listed in the CISA KEV catalog. The vulnerability is not automatable (requires valid NFS credentials), but low-privilege NFS access (AUTH_SYS with an allowed source IP) is sufficient to trigger the overflow (Red Hat CVE).

1. Reconnaissance: Identify NFS/RDMA servers on the target network reachable via InfiniBand or RoCE fabric. Confirm the server exports NFS over RDMA (port 20049 or configured RDMA port) and that a readable file larger than 12,288 bytes is accessible.
2. Obtain NFS credentials: Acquire valid NFS credentials — for AUTH_SYS, this requires only a source IP on an allowed subnet with a valid UID claim. For Kerberos environments, obtain a valid Kerberos ticket for an NFS-permitted principal.
3. Build a crafted RPC-over-RDMA client: Develop or modify an RPC-over-RDMA client to send NFSv3 READ requests via rdma_msg transport type with an empty Write list and no Reply chunk — deliberately omitting the Write and Reply chunk fields that a conformant client would include for large responses.
4. Send the malformed READ request: Issue an NFSv3 READ request for at least 12,288 bytes from the exported file. This causes the server to generate a multi-page reply (3+ pages for a 12 KB response).
5. Trigger the overflow: Because no Write chunk exists, svc_rdma_result_payload() returns 0 (no-op). pcl_process_nonpayloads() treats the full reply as non-payload. svc_rdma_pull_up_needed() forces linearization (pd_num_sges=5 >= sc_max_send_sges=5). svc_rdma_xb_linearize() executes memcpy() calls copying ~12 KB into the 4096-byte sc_xprt_buf, overflowing the kernel heap buffer.
6. Achieve objective: The overflow corrupts adjacent kernel heap objects, resulting in a kernel panic (reliable DoS) or, with a carefully crafted payload targeting specific adjacent heap structures, potential arbitrary kernel code execution with kernel privileges (Red Hat Bugzilla, Red Hat CVE).

• Network: Unusual or malformed RPC-over-RDMA (rdma_msg) traffic on the NFS/RDMA port (default 20049) with oversized READ requests (≥12,288 bytes) lacking Write list and Reply chunk fields; unexpected RDMA connections from hosts not in the authorized NFS client list.
• Logs: Kernel OOPS, panic, or KASAN heap out-of-bounds write reports in /var/log/messages or dmesg referencing svc_rdma_xb_linearize(), svc_rdma_pull_up_reply_msg(), or svc_rdma_sendto.c; NFS server logs showing large READ requests from unexpected clients.
• Process/Kernel: Unexpected kernel crash or reboot of the NFS/RDMA server; KASAN reports mentioning memcpy overflow in svc_rdma_xb_linearize or svc_rdma_pull_up_reply_msg.
• File System: Core dump files or kernel crash dumps (vmcore) generated around the time of suspicious NFS/RDMA activity (Red Hat Bugzilla).

Red Hat acknowledges a patch is available (patch details added September 22, 2026), though specific fixed kernel package versions have not yet been enumerated in the advisory (Red Hat CVE). As an immediate workaround, systems that do not require NFS over RDMA should disable or unload the svcrdma kernel module (modprobe -r svcrdma) to prevent exploitation entirely. If NFS/RDMA is required, restrict network access to the RDMA fabric and NFS/RDMA port to trusted hosts only, and ensure only authorized NFS clients with valid credentials can reach the service. Applying the available kernel security update is the recommended long-term remediation (Red Hat CVE, Red Hat Bugzilla).

Red Hat credited AISLE Research for discovering and reporting this vulnerability (Red Hat CVE). The vulnerability was noted on VulDB and tracked by threat intelligence aggregators shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the official Red Hat advisory and Bugzilla report has been identified at this time.