Description

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdr_count_read_segments() checks only 4-byte alignment; it never compares the position against the received inline body length. In the single-chunk path, svc_rdma_read_complete_one() splits the head and tail kvecs at ch_position. A position past the inline body underflows the tail length, exposing adjacent slab memory to the upper XDR decoder. In the multi-chunk path, svc_rdma_read_multiple_chunks() computes gap lengths between chunks as unsigned subtractions from ch_position. Overlapping Read chunks cause these subtractions to underflow. A final position past the inline body likewise underflows the trailing gap length. svc_rdma_copy_inline_range() then copies past the receive buffer into request pages that are returned to the client through the Reply channel. Bound inline-range copies in svc_rdma_copy_inline_range() against the decoded inline RPC body saved in rc_saved_arg. Reject a single Read chunk positioned beyond that body, and reject multi-chunk lists where accumulated read bytes exceed the next chunk's position. Apply the same position and overlap checks in the call-chunk interleaving path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:35.383Z",
  "pubdate": "2026-09-11T20:19:35.383Z",
  "executiveSummary": "The Linux kernel's svcrdma (RPC/RDMA) implementation contains a critical vulnerability related to the improper validation of Read chunk positions within incoming RPC/RDMA messages. This flaw allows a remote, unauthenticated attacker to supply malformed Read chunk segments that trigger out-of-bounds memory access.\nThe vulnerability manifests as an improper bounds check on the 'ch_position' field, which is used by the server to determine where to place incoming data into the receive buffer. By crafting chunks that specify positions outside the bounds of the actual inline RPC body, an attacker can cause an underflow in buffer length calculations. This leads to the exposure of sensitive adjacent slab memory to the XDR decoder or allows unauthorized copying of data past the receive buffer into request pages, which can subsequently be leaked to the client via the Reply channel.\nThe impact includes potential information disclosure of kernel heap memory and the compromise of data integrity within the RPC/RDMA processing path. Given the nature of the protocol, this vulnerability is exploitable by any client capable of establishing an RDMA connection with the target server, requiring no elevated privileges, making it a significant risk in high-performance storage and networking environments utilizing RDMA.",
  "technicalDetails": "The vulnerability originates in the svcrdma subsystem's handling of RPC/RDMA Read chunks, specifically within xdr_count_read_segments() and subsequent processing functions such as svc_rdma_read_complete_one() and svc_rdma_read_multiple_chunks(). The root cause is the failure to validate the RPC/RDMA 'ch_position' field against the actual length of the received inline RPC body.\nIn the single-chunk processing path, svc_rdma_read_complete_one() utilizes the 'ch_position' field to perform a split operation on the head and tail kvecs. Because the implementation fails to verify that the position does not exceed the inline body length, an attacker can supply a value that causes the tail length calculation to underflow. This results in the XDR decoder processing adjacent slab memory as if it were legitimate message data, leading to an out-of-bounds read.\nIn the multi-chunk processing path, svc_rdma_read_multiple_chunks() calculates the gap between Read chunks using unsigned subtraction based on 'ch_position'. When an attacker provides overlapping chunks or a position that extends beyond the receive buffer, the subtraction triggers an underflow. This bypassed check permits svc_rdma_copy_inline_range() to copy data beyond the allocated receive buffer. These copied bytes are stored in request pages that are later returned to the client, facilitating a cross-memory boundary data leakage.\nThe attack flow follows these steps: 1) The attacker initiates an RPC/RDMA connection and sends a malformed XDR request containing Read chunk segments with malicious 'ch_position' values. 2) The server parses the chunk list using the vulnerable logic, which ignores the relationship between the position and the actual inline body length. 3) For single-chunk requests, the kernel miscalculates kvec boundaries, exposing kernel heap memory to the XDR decoder. 4) For multi-chunk requests, the kernel triggers an arithmetic underflow during gap calculation, leading to an out-of-bounds copy into memory pages designated for the Reply channel. 5) The attacker receives the response, which now contains the sensitive information spilled from the adjacent kernel memory space or the intended out-of-bounds data payload.\nThe exposure is network-based, as the svcrdma listener accepts these malformed packets directly from the wire. No authentication or privileged access is required to reach the vulnerable code path."
}