What happened
A vulnerability identified as CVE-2026-13087 has been discovered in the Linux kernel, specifically affecting the RPC-over-RDMA server reply path. The flaw involves a heap out-of-bounds write that occurs when the server processes a crafted RPC-over-RDMA request. If an affected client sends a large NFS READ request with an empty Write list and no Reply chunk, the server attempts to linearize the entire multi-page reply into a fixed-size heap buffer. Due to insufficient bounds checking, this results in a kernel heap overflow. Exploitation can cause a denial of service via kernel crash, and in some cases, may lead to remote code execution through corruption of adjacent kernel heap objects. The exploit relies on sending specific crafted network payloads to an exposed service, with no user interaction needed for the attack to succeed. The severity of this vulnerability is rated as high, primarily due to the potential for complete compromise of affected systems.
Who is affected
Organisations running affected versions of Red Hat Enterprise Linux, including versions 6 through 10, and Red Hat Enterprise Linux for NVIDIA 26, are impacted by this vulnerability. Any deployment exposed to network traffic that provides access to the vulnerable RPC-over-RDMA service may be susceptible. The vulnerability requires that the network service be accessible remotely and does not demand privileged user access or user interaction for an attacker to exploit. A broad range of environments where these operating systems are deployed in network-exposed configurations are at potential risk.
Recommended actions
- Restrict network access to the RPC-over-RDMA service to prevent untrusted entities from reaching the vulnerable component. Implement network segmentation and access controls at the firewall or network perimeter to limit exposure.
- Maintain awareness of available patches and updates once they are released by the vendor, and apply them promptly upon availability.
- Monitor network traffic for unusual or excessive activity targeting the affected service, which may indicate an attempted exploit.
Indicators of compromise
At present, no specific indicators of compromise have been provided for this vulnerability.
