Executive brief
The Linux kernel's RDMA SRP target (srpt) module handles remote direct memory access operations used for high-speed network storage and data transfer. A network-based attacker can send specially crafted packets with an oversized immediate data length value that causes an integer overflow, bypassing size validation checks and allowing a ~4GB buffer to be processed, leading to memory corruption and potential system compromise.
Technical details
The vulnerability is an integer overflow in the srpt_get_desc_tbl() function in drivers/infiniband/ulp/srpt/ib_srpt.c. The imm_buf->len field is a user-controlled uint32_t value received from the network. When added to imm_data_offset without overflow checking, a malicious initiator can send len=0xFFFFFFFF, causing the resulting req_size calculation to wrap around to a small value, thereby bypassing the bounds check (req_size > srp_max_req_size). This allows the code to subsequently pass a ~4GB length to sg_init_one(), causing memory corruption. The fix uses check_add_overflow() to detect integer overflow before the comparison. Attack vector is network-based and requires no authentication or user interaction; the attacker simply needs to be able to reach the RDMA/SRP service.
Affected products
- Linux Linux kernel All versions with RDMA/srpt immediate data support (introduced in commit 5dabcd0456d7)
Timeline
- 2026-08-15: disclosed: CVE-2026-74394 published
- 2026-05-04: patched: Patch authored by Sara Venkatesh
- 2026-07-24: other: Patch committed to stable tree