CVE-2026-72129 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
nvmet-rdma: handle inline data with a nonzero offset
nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page:
sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off);
When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len)
span crosses a page boundary under-counts the scatterlist.
Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL
identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described affects the Linux kernel's nvme over rdma subsystem where improper handling of inline data with non-zero offsets leads to memory corruption and potential privilege escalation. This issue resides within the nvmet_rdma_use_inline_sg function which manages host-controlled inline data offset mapping into per-command scatterlists. The flaw manifests when a port configuration specifies an inline_data_size parameter exceeding PAGE_SIZE, typically up to max(SZ_16K, PAGE_SIZE). The current implementation performs bounds checking that accepts any offset where off + len <= inline_data_size but fails to properly account for the actual memory layout when offsets exceed page boundaries.
The technical implementation error occurs because the mapping operation assumes data always begins at the first inline page regardless of the specified offset. When an offset falls within the range (PAGE_SIZE, inline_data_size], the calculation "PAGE_SIZE - off" produces negative values that underflow into extremely large unsigned integers, causing sg->length to be set to approximately 4 gigabytes. This misconfiguration allows the block backend to read data far beyond the intended first inline page, creating a significant memory access violation. Additionally, the num_pages(len) calculation completely ignores the offset parameter, leading to incorrect scatterlist sizing when an in-bounds offset spans across page boundaries.
This vulnerability directly relates to CWE-129 Input Validation and CWE-787 Out-of-bounds Write, as it involves improper bounds checking and memory access beyond allocated buffers. The operational impact includes potential system crashes, data corruption, and privilege escalation opportunities that could be exploited through malicious NVMe over RDMA commands. Attackers could leverage this flaw to execute arbitrary code with kernel privileges or cause denial of service conditions affecting storage subsystems.
The fix implements proper offset handling by decomposing the offset into page index and in-page offset components, positioning the scatterlist at the correct starting page, and calculating the page count based on page_off + len. This approach ensures that the scatterlist accurately represents the actual memory layout when offsets are non-zero. The solution also generalizes the inline-SGL identity test in nvmet_rdma_release_rsp() to use range testing rather than simple identity comparison, preventing incorrect identification of persistent inline scatterlists as allocated ones and avoiding premature deallocation of inline pages.
Mitigation strategies should include immediate kernel updates to address this vulnerability, monitoring for suspicious NVMe over RDMA traffic patterns, and implementing network segmentation to limit exposure. System administrators should also consider disabling inline data functionality if not required for their specific use cases, particularly in environments where the risk of malicious NVMe commands cannot be adequately controlled. The fix addresses fundamental memory management issues that align with ATT&CK techniques related to privilege escalation and code execution through kernel vulnerabilities.
Security teams should prioritize patching systems running affected kernel versions, especially those handling high-value storage workloads or serving as network endpoints for NVMe over RDMA services. Regular vulnerability assessments should include checking for proper inline data size configurations and ensuring that security policies restrict potentially dangerous inline data settings to prevent exploitation of this class of memory corruption vulnerabilities. The resolution demonstrates the critical importance of proper offset handling in kernel memory management and validates the need for comprehensive bounds checking in storage subsystem implementations.