CVE-2026-13087

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire multi-page reply into a fixed-size 4096-byte heap buffer without bounds checking, resulting in a kernel heap overflow. This can lead to denial of service via kernel crash or potential code execution through corruption of adjacent kernel heap objects.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Peaked 1d ago at 1 mentions (2026-09-22); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Referenced assets1 URL

By indicator

https://vuldb.com/vuln/408503

Full discourse2 posts

Upwind Security MDR@UpwindMDR17h
🚨High - Linux kernel RPC-over-RDMA heap OOB write in NFS READ reply path (CVE-2026-13087) In net/sunrpc/xprtrdma/svc_rdma_sendto.c, the RPC-over-RDMA server reply path linearizes multi-page NFS READ replies into a fixed 4096-byte heap buffer without bounds checks. A crafted RPC-over-RDMA client can trigger a kernel heap overflow, leading to panic/DoS and potentially code execution via heap object corruption. 👉Affected: Linux kernel (sunrpc/xprtrdma RPC-over-RDMA server) | kernel, kernel-rt
0000036
305 followersView on X
VulDB 🛡@vuldb1d
A severe vulnerability was disclosed for Linux Kernel (CVE-2026-13087) https://vuldb.com/vuln/408503
0000094
2.3K followersView on X

Explore more

Back to dashboard