# CVE-2026-13087

Remote heap overflow in Linux RPC-over-RDMA NFS reply path

- Page: https://www.vulneraibility.com/cve/CVE-2026-13087
- CVSS: 8.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.47%
- Published: 2026-09-22

## Affected

- Linux kernel (net/sunrpc/xprtrdma)
- NFS servers using RPC-over-RDMA (RDMA-enabled)
- Affected Linux distributions (e.g., RHEL)

## Impact

Remote heap OOB write via crafted RPC-over-RDMA NFS request causing kernel crash (DoS) or potential kernel code execution/privilege escalation.

## Action

Immediate action required

## Recommendation

Apply vendor kernel updates; block RDMA/NFS or disable RPC-over-RDMA until patched.

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.