Executive brief
A flaw in the Linux kernel's remote direct memory access (RDMA) transport layer can cause receive buffers to leak and exhaust the receive queue when processing malformed or short network replies. An attacker sending crafted network packets can cause persistent memory leaks and degrade network performance for systems relying on RDMA communication, potentially leading to denial of service.
Technical details
The vulnerability exists in rpcrdma_is_bcall(), which decodes reply headers to classify frames as backchannel calls. A speculative zero-length peek to xdr_inline_decode() returns a pointer without bounds checking, allowing five subsequent 32-bit reads to access up to 20 bytes past the wire payload into stale buffer contents. Additionally, the short-header arm returns true without invoking rpcrdma_bc_receive_call(), causing rpcrdma_reply_handler() to bare-return and skip cleanup (rpcrdma_rep_put() and rpcrdma_post_recvs()). This orphans the DMA-mapped receive buffer, which is freed only at transport teardown. The fix adds bounds checking against xdr->end after the speculative peek and changes the short-header arm to return false, ensuring proper cleanup and receive queue replenishment.
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-08-15: published