Executive brief
The Linux kernel's RPC-over-RDMA service handler can be exploited to write data beyond allocated buffer boundaries when processing large RPC replies without explicit memory regions. An attacker can trigger a buffer overflow that corrupts kernel memory and causes denial of service, or potentially execute arbitrary code with kernel privileges on systems running affected Linux kernels.
Technical details
The vulnerability exists in svc_rdma_pull_up_reply_msg() within the svcrdma subsystem, which linearizes RPC-over-RDMA replies into a fixed-size buffer (sc_xprt_buf, sized at sc_max_req_size bytes). When an RPC client requests a large reply without providing a Write list or Reply chunk, the kernel attempts to pull up the entire response into this buffer. If the reply exceeds sc_max_req_size, svc_rdma_xb_linearize() writes past the buffer boundary, corrupting adjacent slab memory. The corrupted length is then posted to the device's Send Queue, causing the RDMA hardware to read from unmapped memory regions. The fix renames svc_rdma_pull_up_needed() to svc_rdma_check_pull_up() and adds -E2BIG error reporting when a reply cannot fit, allowing the kernel to reject oversized replies with ERR_CHUNK rather than corrupting memory.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Patch resolves the vulnerability by adding buffer size checks and proper error handling