Answer in brief
CVE-2026-72129 records a Unknown severity vulnerability in nvmet-rdma: handle inline data with a nonzero offset. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-72129 records a Unknown severity vulnerability in nvmet-rdma: handle inline data with a nonzero offset. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <c2106ba1b14d644a5203bea1a50dbe25dcad713c || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <bf8bcc1c137d54a62a428b00051fdbb13660673b || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <11401371152b228448a41d79c6de1c938f93049a || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <7c96581169c9d9a7d0726e554313acfbead6141c || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <42a8ea3acd883f4f210d9e54e0975b1e2292b529 || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <2944113ad5fbcdf5d349d857c03d2a44b6de75b8 || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <98bcdfa619150b2f41fa15bac140dbaf2584ad05 || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <48c0162f647bb47e6084ffbc71b8f213f5e2f4f8 | c2106ba1b14d644a5203bea1a50dbe25dcad713c, bf8bcc1c137d54a62a428b00051fdbb13660673b, 11401371152b228448a41d79c6de1c938f93049a, 7c96581169c9d9a7d0726e554313acfbead6141c, 42a8ea3acd883f4f210d9e54e0975b1e2292b529, 2944113ad5fbcdf5d349d857c03d2a44b6de75b8, 98bcdfa619150b2f41fa15bac140dbaf2584ad05, 48c0162f647bb47e6084ffbc71b8f213f5e2f4f8 |
| Linux/Linuxgeneric | 4.19 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <c2106ba1b14d644a5203bea1a50dbe25dcad713c || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <bf8bcc1c137d54a62a428b00051fdbb13660673b || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <11401371152b228448a41d79c6de1c938f93049a || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <7c96581169c9d9a7d0726e554313acfbead6141c || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <42a8ea3acd883f4f210d9e54e0975b1e2292b529 || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <2944113ad5fbcdf5d349d857c03d2a44b6de75b8 || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <98bcdfa619150b2f41fa15bac140dbaf2584ad05 || >=0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349 <48c0162f647bb47e6084ffbc71b8f213f5e2f4f8 | c2106ba1b14d644a5203bea1a50dbe25dcad713c, bf8bcc1c137d54a62a428b00051fdbb13660673b, 11401371152b228448a41d79c6de1c938f93049a, 7c96581169c9d9a7d0726e554313acfbead6141c, 42a8ea3acd883f4f210d9e54e0975b1e2292b529, 2944113ad5fbcdf5d349d857c03d2a44b6de75b8, 98bcdfa619150b2f41fa15bac140dbaf2584ad05, 48c0162f647bb47e6084ffbc71b8f213f5e2f4f8 |
| Linux/Linuxgeneric | 4.19 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).
Quoted source text, attributed separately from HOL analysis.