Executive brief
A vulnerability was identified in the Linux kernel's RDMA (Remote Direct Memory Access) implementation, which is used for high-speed data transfers between systems. The flaw allows for an out-of-bounds memory access during certain data copy operations. If exploited, this could lead to system instability, data corruption, or unauthorized access to sensitive information.
Technical details
The vulnerability exists within the 'svc_rdma_copy_inline_range' function in 'net/sunrpc/xprtrdma/svc_rdma_rw.c'. The function indexed the 'rqstp->rq_pages' array using 'rc_curpage' (or 'ri_pageno' in some versions) without verifying that the index remained within the bounds of the allocated page array. This lack of validation can lead to an out-of-bounds read or write. The issue has been resolved by adding explicit guards to check the index against the maximum number of pages before access and after advancing to new pages. The vulnerability is reachable over the network if RDMA services are exposed.
Affected products
- Linux Linux Kernel 5.11 to 5.15.198, 6.0 to 6.6.120, 6.12 to 6.12.64, 6.18 to 6.18.3
Timeline
- 2025-11-07: disclosed: Initial patch authored
- 2025-12-08: patched: Mainline kernel patch committed
- 2026-01-13: advisory: CVE published
References
- https://git.kernel.org/stable/c/5f140b525180c628db8fa6c897f138194a2de417
- https://git.kernel.org/stable/c/7ba826aae1d43212f3baa53a2175ad949e21926e
- https://git.kernel.org/stable/c/a22316f5e9a29e4b92030bd8fb9435fe0eb1d5c9
- https://git.kernel.org/stable/c/d1bea0ce35b6095544ee82bb54156fc62c067e58
- https://git.kernel.org/stable/c/da1ccfc4c452541584a4eae89e337cfa21be6d5a