Executive brief
The Linux kernel's RPC/RDMA server implementation (svcrdma) contains a resource management flaw in how it processes remote Read requests from network clients. An attacker sending specially crafted Read segment requests with oversized lengths can trigger memory allocation failures that leave allocated resources unreleased, gradually exhausting the server's memory and eventually causing service degradation or denial of service.
Technical details
The vulnerability is a resource leak in the RPC/RDMA Read list decoder (svcrdma). The xdr_count_read_segments() function accepts wire-supplied segment lengths without validating that they fit within the receive context's page budget (rc_maxpages). When an oversized rs_length is passed to svc_rdma_build_read_segment(), it attempts to allocate a large dynamic buffer vector (bvec) based on the unchecked length. If a page-overrun guard fires after this allocation, the freshly acquired read-write context (rw context) is not properly released, leaking the resource. The patch adds validation to reject segments exceeding the page budget during initial decoding and ensures the rw context is returned on error paths, eliminating the leak vector.
Affected products
- Linux Linux kernel 5.3 and later (approximately; affecting any kernel with svcrdma RPC/RDMA support from commit 5ee62b4a9113 onward)
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-05-26: patched: Upstream fix committed by Chuck Lever
- 2026-09-07: patched: Backport to stable kernels merged