CVE-2026-72129
nvmet-rdma: handle inline data with a nonzero offset
Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).
INFO
Published Date :
Aug. 15, 2026, 6:21 a.m.
Last Modified :
Aug. 17, 2026, 6:18 a.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the latest version.
- Apply the specific patch for nvmet-rdma inline data handling.
- Verify the fix by testing the nvmet-rdma functionality.
- Restart affected services or systems if necessary.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72129.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72129 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72129
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72129 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72129 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': 'c2106ba1b14d644a5203bea1a50dbe25dcad713c', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': 'bf8bcc1c137d54a62a428b00051fdbb13660673b', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '11401371152b228448a41d79c6de1c938f93049a', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '7c96581169c9d9a7d0726e554313acfbead6141c', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '42a8ea3acd883f4f210d9e54e0975b1e2292b529', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '2944113ad5fbcdf5d349d857c03d2a44b6de75b8', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '98bcdfa619150b2f41fa15bac140dbaf2584ad05', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '48c0162f647bb47e6084ffbc71b8f213f5e2f4f8', 'versionType': 'git'}], 'programFiles': ['drivers/nvme/target/rdma.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/nvme/target/rdma.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': 'c2106ba1b14d644a5203bea1a50dbe25dcad713c', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': 'bf8bcc1c137d54a62a428b00051fdbb13660673b', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '11401371152b228448a41d79c6de1c938f93049a', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '7c96581169c9d9a7d0726e554313acfbead6141c', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '42a8ea3acd883f4f210d9e54e0975b1e2292b529', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '2944113ad5fbcdf5d349d857c03d2a44b6de75b8', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '98bcdfa619150b2f41fa15bac140dbaf2584ad05', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '48c0162f647bb47e6084ffbc71b8f213f5e2f4f8', 'versionType': 'git'}], 'programFiles': ['drivers/nvme/target/rdma.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/nvme/target/rdma.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': 'c2106ba1b14d644a5203bea1a50dbe25dcad713c', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': 'bf8bcc1c137d54a62a428b00051fdbb13660673b', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '11401371152b228448a41d79c6de1c938f93049a', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '7c96581169c9d9a7d0726e554313acfbead6141c', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '42a8ea3acd883f4f210d9e54e0975b1e2292b529', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '2944113ad5fbcdf5d349d857c03d2a44b6de75b8', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '98bcdfa619150b2f41fa15bac140dbaf2584ad05', 'versionType': 'git'}, {'status': 'affected', 'version': '0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349', 'lessThan': '48c0162f647bb47e6084ffbc71b8f213f5e2f4f8', 'versionType': 'git'}], 'programFiles': ['drivers/nvme/target/rdma.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/nvme/target/rdma.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()). Added Reference https://git.kernel.org/stable/c/11401371152b228448a41d79c6de1c938f93049a Added Reference https://git.kernel.org/stable/c/2944113ad5fbcdf5d349d857c03d2a44b6de75b8 Added Reference https://git.kernel.org/stable/c/42a8ea3acd883f4f210d9e54e0975b1e2292b529 Added Reference https://git.kernel.org/stable/c/48c0162f647bb47e6084ffbc71b8f213f5e2f4f8 Added Reference https://git.kernel.org/stable/c/7c96581169c9d9a7d0726e554313acfbead6141c Added Reference https://git.kernel.org/stable/c/98bcdfa619150b2f41fa15bac140dbaf2584ad05 Added Reference https://git.kernel.org/stable/c/bf8bcc1c137d54a62a428b00051fdbb13660673b Added Reference https://git.kernel.org/stable/c/c2106ba1b14d644a5203bea1a50dbe25dcad713c