Description

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more scatter/gather entries than the device's Send Queue supports, svc_rdma_pull_up_needed() selects pull-up and svc_rdma_pull_up_reply_msg() linearizes the whole reply into sctxt->sc_xprt_buf. That buffer is only sc_max_req_size bytes, while the reply on this path is bounded only by the client's request, so svc_rdma_xb_linearize() copies past the end of the buffer and corrupts adjacent slab memory. The oversized length is then stored in sc_sges[0].length and posted, so the device also reads beyond the mapped region. The SGE-exhaustion branch is the only pull-up path that can exceed the buffer: the threshold branch pulls up only replies smaller than RPCRDMA_PULLUP_THRESH, and replies that fit the device's SGE budget are sent directly without linearization. Make svc_rdma_pull_up_needed() report -E2BIG when the reply it would pull up cannot fit sc_max_req_size, and fail the request with ERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping the connection. The helper no longer answers a simple yes/no question: it now reports pull-up, no pull-up, or -E2BIG for a reply too large to linearize. Rename svc_rdma_pull_up_needed() to svc_rdma_check_pull_up() so its name no longer implies a boolean predicate.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:35.850Z",
  "pubdate": "2026-09-11T20:19:35.850Z",
  "executiveSummary": "A buffer overflow vulnerability exists in the Linux kernel's svcrdma (RPC-over-RDMA) implementation due to improper bounds checking when linearizing large replies.\nThe vulnerability occurs when an RPC-over-RDMA client requests a reply that exceeds the device's Send Queue scatter/gather (SGE) capacity, triggering an forced 'pull-up' mechanism.\nBecause the buffer size is constrained by sc_max_req_size while the reply length remains bounded only by the client request, the system copies data past the allocated heap boundary, resulting in memory corruption of adjacent slab objects.\nThis vulnerability poses a significant risk to system stability and security, as an unauthenticated remote attacker can trigger kernel-mode memory corruption.\nSuccessful exploitation could lead to local or remote code execution, denial of service (system panic), or information disclosure, depending on the nature of the corrupted slab data.\nThe flaw affects the RPC-over-RDMA transport layer and is reachable via network traffic, requiring no specific user privileges if an RDMA-capable service is exposed.",
  "technicalDetails": "The vulnerability resides within the svcrdma transport layer, specifically in how the kernel handles replies that exceed the hardware's scatter/gather (SGE) element limit. When the svc_rdma_pull_up_needed() function determines that a reply cannot be sent directly via RDMA due to SGE exhaustion, it invokes a pull-up mechanism to linearize the reply into a contiguous buffer.\nThe root cause is a lack of boundary validation in the pull-up logic. The buffer used for linearization, identified as sctxt->sc_xprt_buf, is limited to sc_max_req_size bytes. However, the logic fails to compare the incoming reply's total size against this fixed buffer size before initiating the memory copy via svc_rdma_xb_linearize().\nAttack flow: 1. The attacker sends a malformed or crafted RPC-over-RDMA request that demands a large response (e.g., an NFS READ payload) without providing necessary Write lists or Reply chunks. 2. The kernel's svcrdma component determines the response exceeds the SGE capacity of the Send Queue. 3. The kernel invokes the pull-up mechanism to linearize the data into the internal sc_xprt_buf. 4. Because there is no length check, the memory copy operation writes data beyond the allocated sc_xprt_buf, overwriting adjacent kernel slab memory. 5. The corrupted length is then stored in sc_sges[0].length, and the device is instructed to read from this out-of-bounds memory region, potentially leading to unauthorized memory access or kernel exploitation.\nThe vulnerability allows for heap-based slab corruption. By precisely controlling the size and content of the RPC request, an attacker may be able to overwrite kernel objects, function pointers, or data structures adjacent to the transport buffer in the slab allocator. This can lead to arbitrary code execution within the kernel context or a system crash (kernel panic).\nThe issue is fixed by refactoring the helper function (renamed to svc_rdma_check_pull_up) to enforce strict validation against sc_max_req_size. If the reply exceeds this buffer limit, the kernel now returns -E2BIG and terminates the request using the ERR_CHUNK status code, as per RFC 8166 Section 4.5.3, preventing the buffer overflow from occurring entirely."
}