Executive brief
The Linux kernel's NFS server, when configured to serve data over high-speed RDMA networks, contains a memory safety flaw in how it handles network requests. An authenticated attacker can craft a malicious network request to trigger a buffer overflow on the server, causing it to crash or potentially execute arbitrary code with kernel privileges. This affects servers using NFS/RDMA in datacenters and high-performance computing environments.
Technical details
A heap out-of-bounds write vulnerability exists in net/sunrpc/xprtrdma/svc_rdma_sendto.c where the RPC-over-RDMA server linearizes multi-page replies into a fixed 4096-byte buffer without bounds checking. An authenticated NFS client can trigger the overflow by sending a large READ request with an empty Write list and no Reply chunk. Exploitation requires network access to an NFS/RDMA server, RDMA hardware (InfiniBand/RoCE), and valid NFS client credentials.
Affected products
- Linux Linux Kernel Versions with CONFIG_SUNRPC_XPRT_RDMA enabled and RPC-over-RDMA support
Timeline
- 2026-09-22: disclosed