Executive brief
The Linux kernel's RDMA (Remote Direct Memory Access) subsystem contains arithmetic errors in chunk offset calculations that can cause integer underflow and memory allocation failures. An attacker with network access to an RDMA-enabled system could trigger these bugs to cause denial of service or potentially execute code through oversized memory allocations.
Technical details
The svc_rdma_read_chunk_range() function in the Linux kernel's svcrdma module contains two arithmetic defects when processing RDMA read chunks. First, a boundary check uses '>' instead of '>=', allowing a fully-consumed segment to fall through and trigger a u32 underflow when length is smaller than the segment length. Second, the length calculation applies the offset subtraction after the min_t() cap instead of before, causing incorrect segment lengths and silent data loss. Additionally, the function fails to handle zero-length requests correctly, rejecting valid operations. These bugs can be triggered remotely via RDMA requests, leading to oversized kmalloc_array allocations (multi-MiB) and potential memory exhaustion or kernel crashes.
Affected products
- Linux Linux kernel versions containing svcrdma module (exact range not specified in advisory)
Timeline
- 2026-09-11: disclosed