Executive brief
The Linux kernel's RPC/RDMA server component fails to properly validate Read chunk position fields supplied by remote clients, allowing an attacker to trigger integer underflows that expose kernel memory or write data beyond buffer boundaries. A malicious NFS or similar RPC client can exploit this to leak sensitive kernel data or corrupt memory on systems using RDMA transport, potentially leading to system compromise or denial of service.
Technical details
This vulnerability is an integer underflow in the svcrdma (SUNRPC RDMA) kernel subsystem. The RPC/RDMA protocol handler accepts Read chunk position fields from remote clients without validating them against the inline body length. In single-chunk scenarios, invalid positions cause unsigned integer underflows when splitting key-value vectors (kvecs), exposing adjacent slab memory. In multi-chunk paths, overlapping chunks trigger further underflows during gap-length computation, and svc_rdma_copy_inline_range() may copy past the receive buffer into request pages returned to the client. The vulnerability requires network-level access to an RPC/RDMA server (commonly NFS). The fix (applied 2026-08-03) adds bounds checks against the decoded inline RPC body (rc_saved_arg) to reject invalid positions and overlapping chunk ranges. Patches have been backported to all stable kernel branches.
Affected products
- Linux Linux kernel all versions with svcrdma (2.6.11+)
Timeline
- 2026-09-11: disclosed
- 2026-08-03: patched: Fix committed upstream; backported to stable branches