External risk intelligence

Linux Kernel NVMe-RDMA Offset Handling Flaw

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72129

The vulnerability exists in the Linux kernel's NVMe over RDMA (nvmet-rdma) implementation. While it involves network-reachable protocols, RDMA is typically deployed within high-performance, private, or isolated data center fabric environments rather than exposed directly to the public internet.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the Linux kernel's NVMe over RDMA (nvmet-rdma) component. This issue could allow unauthorized access to data by improperly handling data offsets within the kernel's memory management. The main concern at this time is confirming whether this specific technology is in use and potentially exposed.

Kernel bug affects NVMe over RDMA data handling.
Leadership should remember potential for unauthorized data access.
Confirm use and exposure of affected technology.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic to a Linux system that uses the NVMe-RDMA protocol. This traffic would target the `nvmet-rdma` component within the kernel, specifically when it handles inline data with an offset. If successful, the attacker could cause the system to read beyond intended memory boundaries, potentially leading to unauthorized access and modification of data.

Network access required.
Incorrect offset handling triggers vulnerability.
Unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to read or write data beyond intended boundaries within the kernel's memory. This is possible when the `nvmet-rdma` subsystem handles inline data with a non-zero offset, leading to incorrect scatterlist calculations and potential memory corruption.

Kernel memory integrity.
Network access to affected subsystem.
Unauthorized memory reads and writes.

Operational Fix

Recommended remediation, mitigation, and detection steps

This Linux kernel vulnerability in nvmet-rdma could be addressed by infrastructure or platform teams responsible for the kernel and its networking components. The first step is to identify systems running the affected kernel version, determine if the nvmet-rdma functionality is enabled and exposed, and then assess the business criticality of those systems to prioritize remediation efforts.

Kernel and platform teams should own this.
Verify nvmet-rdma enablement and exposure.
Plan targeted updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel's nvmet-rdma component?

The nvmet-rdma component is part of the Linux kernel that enables Non-Volatile Memory express (NVMe) storage devices to communicate over a network using Remote Direct Memory Access (RDMA). It allows servers to access high-speed storage across a network fabric with very low latency, bypassing traditional software overhead. This technology is commonly used in high-performance computing, large-scale data centers, and enterprise storage arrays to provide fast, efficient access to remote block storage devices.

What is the memory management weakness in CVE-2026-72129?

This vulnerability is an improper input validation error affecting how the kernel maps data offsets. When the system receives data with a non-zero offset in an NVMe-RDMA request, the internal memory pointer calculations can fail. This leads the system to calculate an incorrect memory length, causing the storage backend to read or write far beyond the intended memory page boundary. In technical terms, it causes an integer underflow that disrupts the kernel's memory safety mechanisms.

How can an attacker trigger this vulnerability?

An attacker needs network access to the target system's RDMA-enabled interface. The vulnerability is triggered by sending a specially crafted NVMe-RDMA request that specifies a non-zero inline data offset, particularly when the system is configured with a large inline data size. Standard requests that do not involve these specific non-zero offsets or do not use the inline data feature are not susceptible to this specific memory boundary calculation error.

Do I need to worry if my system is internal?

According to Halo Surface Signal, this vulnerability is considered 'Unlikely' to be exploited from the public internet. While the flaw is technically network-reachable, RDMA protocols are almost exclusively deployed within private, high-performance data center networks. You should prioritize internal systems that have RDMA fabrics enabled, as these represent the most relevant attack surface for this issue, rather than systems exposed to the broader, public internet.

When should I address CVE-2026-72129?

Begin by auditing your infrastructure to identify which systems are running Linux kernels with the nvmet-rdma subsystem active. Verify if your specific network configuration utilizes RDMA for storage traffic. Once identified, prioritize these systems for kernel updates during your next scheduled maintenance window, ensuring your infrastructure team coordinates the deployment to mitigate potential risks to kernel memory integrity.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.