Executive brief
The Linux kernel's RDMA transport layer has a memory access bug in handling network chunks with zero segments. An attacker sending specially crafted RDMA protocol messages can trigger an out-of-bounds read that crashes the kernel, disrupting services relying on RDMA networking and potentially leading to denial of service.
Technical details
The vulnerability is an out-of-bounds read in the pcl_for_each_segment macro within the svcrdma (RDMA service transport) code. When a parsed chunk list contains a chunk with ch_segcount == 0, the macro computes an upper bound by subtracting 1 from the u32 segcount, causing integer underflow to 0xFFFFFFFF. This places the loop boundary far past the ch_segments flex array. An attacker can construct a Write or Reply chunk with zero segments that reaches the wire through xdr_check_write_chunk(), which only validates segcount against rc_maxpages. When Send-With-Invalidate is negotiated, svc_rdma_get_inv_rkey() iterates the chunk lists and dereferences the out-of-bounds segment->rs_handle, triggering a general protection fault. The fix changes pcl_for_each_segment to a half-open bound using ch_segcount directly, skipping the loop body when segcount is zero.
Affected products
- Linux Linux kernel multiple
Timeline
- 2026-09-11: disclosed