{"apiVersion":"1.0","identifier":"CVE-2026-72129","description":"In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes -PAGE_SIZE - off- underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).","publishedAt":"2026-08-15T06:21:30","lastModifiedAt":"2026-08-17T06:18:12","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72129","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00704,"riskScore":1.04,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72129","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72129","en":"https://www.redsauce.net/en/cves/CVE-2026-72129","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72129","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72129","de":"https://www.redsauce.net/de/cves/CVE-2026-72129","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72129","el":"https://www.redsauce.net/el/cves/CVE-2026-72129"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72129"}}