Executive brief
A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) over Ethernet driver could allow a remote attacker to cause a system crash or potentially corrupt memory. The issue occurs when the system receives more data than expected during a read operation, leading to an out-of-bounds write. This affects systems using the Soft-iWARP (siw) driver for high-performance networking.
Technical details
An out-of-bounds write vulnerability exists in drivers/infiniband/sw/siw/siw_qp_rx.c within the siw_proc_rresp() function. The root cause is a failure to validate the accumulated length of inbound Read Response DDP segments against the sink buffer length on continuation segments. A remote peer can send a sequence of segments with the DDP Last flag cleared that exceeds the requested RREAD length, driving the 'wqe->processed' offset beyond the validated buffer boundary. This results in an out-of-bounds write during the subsequent siw_rx_data() call. The vulnerability is reachable over routable TCP by any established RDMA connection peer without requiring local privileges. The fix introduces bounds checking for every segment before placement.
Affected products
- Linux Linux Kernel 8b6a361b8c48 to a31b6d18ded3cc32d9ee85a6ff0726d4274887b2
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
References
- https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf
- https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5
- https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba
- https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851
- https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3
- https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b
- https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2