Junglewise Threat Intelligence

CVE-2026-64269: Linux Kernel RDMA rtrs-srv out-of-bounds read in rdma_write_sg

CVE-2026-64269 · Severity: info · CVSS 0 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem could allow a remote attacker to read sensitive host memory. By sending a specially crafted request with an oversized data length, an attacker can bypass security checks and access memory outside of the intended storage area. This could lead to the exposure of private system information or cause the connection to crash, depending on the system's hardware configuration.

Technical details

A vulnerability exists in the RDMA Transport Remote Storage (RTRS) server component of the Linux kernel. When processing an RTRS READ request, the function 'rdma_write_sg' uses a length value ('desc[0].len') provided by the remote peer without verifying it against the maximum chunk size. Because the local DMA LKEY used is not restricted to the specific Memory Region (MR) mapping, the hardware does not automatically enforce bounds. An attacker can provide a length exceeding the 'max_chunk_size' to trigger an out-of-bounds read. On systems without an IOMMU or in passthrough mode, this results in information disclosure of adjacent host memory; on systems with a translating IOMMU, it typically causes a fault and connection termination. The fix introduces a check to reject descriptor lengths exceeding 'max_chunk_size'.

Affected products

  • Linux Linux Kernel 9cb837480424 to 68c09762172f

Timeline

  • 2026-06-12: other: Vulnerability reported by Yuhao Jiang
  • 2026-07-24: patched: Fix committed to stable kernel trees
  • 2026-07-25: disclosed: CVE published

References

Related threats