Answer in brief
CVE-2026-72129 records a Critical severity (CVSS 9.8) vulnerability in nvmet-rdma: handle inline data with a nonzero offset. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <c2106ba1b14d644a5203bea1a50dbe25dcad713c || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <bf8bcc1c137d54a62a428b00051fdbb13660673b || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <11401371152b228448a41d79c6de1c938f93049a || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <7c96581169c9d9a7d0726e554313acfbead6141c || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <42a8ea3acd883f4f210d9e54e0975b1e2292b529 || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <2944113ad5fbcdf5d349d857c03d2a44b6de75b8 || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <98bcdfa619150b2f41fa15bac140dbaf2584ad05 || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <48c0162f647bb47e6084ffbc71b8f213f5e2f4f8 | c2106ba1b14d644a5203bea1a50dbe25dcad713c, bf8bcc1c137d54a62a428b00051fdbb13660673b, 11401371152b228448a41d79c6de1c938f93049a, 7c96581169c9d9a7d0726e554313acfbead6141c, 42a8ea3acd883f4f210d9e54e0975b1e2292b529, 2944113ad5fbcdf5d349d857c03d2a44b6de75b8, 98bcdfa619150b2f41fa15bac140dbaf2584ad05, 48c0162f647bb47e6084ffbc71b8f213f5e2f4f8 |
| Linux/Linuxgeneric | 4.19 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).
Quoted source text, attributed separately from HOL analysis.