Executive brief
A vulnerability exists in the Linux kernel's RDMA (Remote Direct Memory Access) server component, which is used for high-speed data transfers between systems. Due to a coding error in how memory offsets are calculated, data could be written to incorrect memory locations. This could allow a remote attacker to cause a system crash, corrupt data, or potentially gain unauthorized control over the server.
Technical details
A vulnerability in the svcrdma component of the Linux kernel arises from an incorrect offset calculation in the svc_rdma_copy_inline_range function. The code incorrectly used a page index (rc_curpage) as a byte offset for a memcpy operation instead of the intended byte offset (rc_pageoff). This logic error results in out-of-bounds writes or memory corruption within the kernel's page address space. An attacker can trigger this via network-based RDMA requests without authentication. Patches have been released in stable kernel versions 6.12.64, 6.18.3, and 6.19.
Affected products
- Linux Linux Kernel 6.8 to 6.12.63, 6.13 to 6.18.2
Timeline
- 2025-11-07: other: Patch authored
- 2026-01-13: advisory: CVE published
- 2026-01-13: patched: Fixes merged into stable branches