Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one(). Use check_add_overflow() to detect wrapping before the comparison.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T06:22:41.363Z",
  "pubdate": "2026-08-15T06:22:41.363Z",
  "executiveSummary": "An integer overflow vulnerability exists in the RDMA/srpt subsystem of the Linux kernel, specifically within the immediate data length check mechanism. The flaw arises because imm_buf->len is a user-controlled uint32_t received directly from the network, which is subsequently added to imm_data_offset without proper bounds or overflow validation.\nThis vulnerability allows a malicious network initiator to supply a crafted length value, such as 0xFFFFFFFF, triggering an integer wrap-around in the calculation of req_size. This bypassed computation successfully evades subsequent security bounds checks.\nConsequently, the subsystem passes an invalid, massive length of approximately 4GB to the sg_init_one() function, leading to out-of-bounds memory operations, potential system crashes, memory corruption, or potentially arbitrary code execution within kernel space.\nThe attack requires network access to the target system running the RDMA SCSI target (srpt) module and an authenticated or unauthenticated connection depending on the RDMA fabric configuration, granting the remote attacker the capability to compromise kernel stability and integrity.",
  "technicalDetails": "The vulnerability resides in the Linux kernel RDMA SCSI Target (srpt) driver, specifically in the handling and validation of immediate data lengths received from remote initiators over the network.\nThe root cause is an unchecked arithmetic addition involving a user-supplied 32-bit unsigned integer (`imm_buf->len`) and an internal offset (`imm_data_offset`). Because the code fails to check for integer overflow prior to performing the addition, a malicious initiator can supply an abnormally large value like `0xFFFFFFFF`.\nWhen this value is added to `imm_data_offset`, the resulting sum exceeds the maximum capacity of the integer type, causing `req_size` to wrap around to an unexpectedly small value. This small wrapped value successfully circumvents the intended security bounds checks designed to validate request sizes.\nFollowing the bypassed bounds check, the system trusts the erroneous size calculations and invokes `sg_init_one()` with a length parameter approximating 4 gigabytes.\nThe attack flow proceeds as follows: First, the malicious initiator establishes an RDMA connection with the target running the `srpt` module. Second, the initiator crafts a malicious RDMA request packet containing a specially manipulated immediate data length (`imm_buf->len = 0xFFFFFFFF`). Third, the target kernel parses the packet and performs the vulnerable arithmetic addition, resulting in an integer wrap-around of `req_size`. Fourth, the request passes the validation checks due to the small wrapped value. Fifth, the kernel passes the massive ~4GB length to `sg_init_one()`, triggering memory corruption, kernel panic, or unpredictable system behavior.\nNetwork exposure is present wherever the RDMA/srpt target service is listening and accessible to initiators. Privilege and authentication requirements depend on the specific RDMA fabric deployment, but network-adjacent or remote attackers capable of communicating with the target can execute the payload."
}