Executive brief
A vulnerability in the Linux kernel's SCSI RDMA Protocol (SRP) implementation could allow a compromised storage server to crash a connected client. By sending a specially crafted response message, the server can trigger an out-of-bounds memory read on the client system. This primarily impacts the stability and availability of systems using InfiniBand or RoCE storage networking.
Technical details
The vulnerability exists in the srp_process_rsp() function within drivers/infiniband/ulp/srp/ib_srp.c. The function copies SCSI sense data using an offset (resp_data_len) provided by the SRP target without verifying that the offset and the subsequent sense data fit within the actual received byte length (wc->byte_len). An attacker-controlled target can provide a large 32-bit resp_data_len value, causing the memcpy source address to point far beyond the allocated receive buffer, resulting in a kernel read fault. The fix introduces bounds checking to ensure the response header, data, and sense regions are contained within the received message length.
Affected products
- Linux Linux kernel 3.x, 4.x, 5.x, 6.x
Timeline
- 2026-06-02: other: Patch submitted by researcher
- 2026-06-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/0b9ee09d5e849591f17d98c078033dadea967293
- https://git.kernel.org/stable/c/0d64bc200ebe4f275b27438c6e593903e0b16fe1
- https://git.kernel.org/stable/c/13e91fd076306f5d0cdfa14f53d69e37274723c4
- https://git.kernel.org/stable/c/2015038195939eac54a1ee83c9d98ef1a8ccbbce
- https://git.kernel.org/stable/c/3523e53ff95f1837ec3f57ff7558532bcb2661b7
- https://git.kernel.org/stable/c/3889517c2ec7f364914aea8209abfff735f7ecde
- https://git.kernel.org/stable/c/ed77cc819ad631264787cade5ae5ec4c535ec6bb