CVE-2026-13087

✕ Withdrawn — historical dataHIGHPre-NVD 8.8
8.8CVSS

A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire multi-page reply into a fixed-size 4096-byte heap buffer without bounds checking, resulting in a kernel heap overflow. This can lead to denial of service via kernel crash or potential code execution through corruption of adjacent kernel heap objects.

CVSS v3
8.8
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

September 22, 2026

Last Modified

September 22, 2026

References (2)

Frequently asked(4)

What is CVE-2026-13087?
CVE-2026-13087 is a rejected CVE ID: its record was withdrawn on September 30, 2026 and no longer describes a vulnerability. Reason given: This CVE was reserved in error and duplicates CVE-2026-89530.
When was the CVE record for CVE-2026-13087 published?
The CVE record for CVE-2026-13087 was published on September 22, 2026. EchelonGraph's copy of the record carries a last-modified date of September 22, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-13087?
CVE-2026-13087 has a CVSS base score of 8.8 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2026-13087?
There is nothing to remediate under CVE-2026-13087: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.