Executive brief
A vulnerability in the Linux kernel's RDMA transport layer can allow a remote attacker to exhaust the client's Receive buffer queue by sending a stream of malformed network replies. This causes the transport connection to stall and eventually fail, resulting in a denial of service that disrupts RPC communication between systems relying on RDMA for high-performance remote procedure calls.
Technical details
The vulnerability exists in the xprtrdma (RPC/RDMA) transport layer of the Linux kernel. When rpcrdma_reply_handler() processes replies, it fails to repost replacement Receive work requests (WRs) for two error paths: bad-version replies and short replies that do not meet the fixed transport header size. A remote peer can exploit this by sending a sustained stream of such malformed replies, each consuming one posted Receive buffer without replacement. Once the Receive queue is depleted, subsequent Sends from the peer find no posted Receives, causing the transport to stall until reconnect. The fix routes both error exits through a shared repost tail that refills the queue against rb_credits (the most recent accepted credit grant), ensuring Receives remain posted even when handling malformed replies.
Affected products
- Linux Linux kernel versions including xprtrdma transport layer prior to the fix
Timeline
- 2026-08-15: disclosed
- patched: Commit 2ae50ad68cd7 introduced the regression; fix routes both malformed-reply exits through shared repost tail