Description

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pcl_for_each_segment for empty chunks When a parsed chunk list contains a chunk whose ch_segcount is zero, pcl_for_each_segment computes its inclusive upper bound as &chunk->ch_segments[ch_segcount - 1]. ch_segcount is u32, so the subtraction wraps to 0xFFFFFFFF and the bound lands far past the ch_segments flex array. The loop body then walks unrelated memory at sizeof(struct svc_rdma_segment) stride until it faults. A zero-segcount chunk is reachable from the wire: xdr_check_write_chunk() only rejects segcount values greater than rc_maxpages, and pcl_alloc_write() links a freshly allocated chunk onto rc_write_pcl/rc_reply_pcl before its segment-fill loop runs, so a Write or Reply chunk advertising zero segments leaves ch_segcount == 0 on the list. When the transport has negotiated Send-With-Invalidate, svc_rdma_get_inv_rkey() iterates all four PCLs with pcl_for_each_segment and dereferences segment->rs_handle on each iteration, turning the underflow into an out-of-bounds read and a general protection fault. xdr_check_write_list / xdr_check_reply_chunk pcl_alloc_write() chunk = pcl_alloc_chunk(...) /* ch_segcount = 0 */ list_add_tail(&chunk->ch_list, &pcl->cl_chunks) /* fill loop iterates zero times for wire segcount 0 */ svc_rdma_get_inv_rkey() pcl_for_each_chunk(rc_write_pcl) pcl_for_each_segment(segment, chunk) pos <= &ch_segments[0u - 1u] /* 0xFFFFFFFF */ segment->rs_handle /* OOB read -> GPF */ Fix by switching the macro to a half-open upper bound that uses ch_segcount directly. For ch_segcount == 0 the loop start equals the loop end and the body is skipped; for ch_segcount > 0 the iteration range is unchanged. All six existing call sites in net/sunrpc/xprtrdma/svc_rdma_recvfrom.c and net/sunrpc/xprtrdma/svc_rdma_rw.c remain correct under the new bound, so no caller changes are needed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-11T20:19:36.117Z",
  "pubdate": "2026-09-11T20:19:36.117Z",
  "executiveSummary": "A critical out-of-bounds read vulnerability exists in the Linux kernel's svcrdma (RPC-over-RDMA) implementation.\nThe flaw originates from an integer underflow when calculating memory boundaries for chunk segments containing zero segments.\nThis vulnerability affects the svcrdma transport mechanism, allowing a remote attacker to trigger a General Protection Fault (GPF) and potentially conduct an information disclosure attack.\nExploitation requires the attacker to send a specially crafted RPC-over-RDMA message containing a chunk list with a segment count of zero.\nThe issue is reachable via the network when the transport has negotiated Send-With-Invalidate, as the kernel iterates through parsed chunk lists to validate rkeys.\nSuccessful exploitation results in kernel panic (denial of service) or potential leakage of sensitive kernel memory due to the out-of-bounds pointer dereference.\nThe risk is considered significant due to its impact on system stability and potential for memory corruption, requiring immediate patching of the affected kernel components.",
  "technicalDetails": "The root cause of this vulnerability is an integer underflow in the pcl_for_each_segment macro used within the Linux kernel's svcrdma component.\nWhen a parsed chunk list contains a chunk where the ch_segcount field is zero, the macro calculates the inclusive upper bound for iteration as &chunk->ch_segments[ch_segcount - 1].\nBecause ch_segcount is defined as a u32 type, the expression (0 - 1) results in 0xFFFFFFFF. This causes the loop's upper bound to point to an address far beyond the allocated ch_segments flex array.\nThe vulnerability is triggered during the execution of svc_rdma_get_inv_rkey(), which iterates over four PCL (Parsed Chunk List) structures using the vulnerable macro. When processing a chunk with zero segments, the macro dereferences segment->rs_handle using the overflowed address.\nAttack Flow: 1) An attacker sends a malicious RPC-over-RDMA request. 2) The xdr_check_write_list or xdr_check_reply_chunk functions parse the request. 3) pcl_alloc_write() allocates a chunk, links it, and sets ch_segcount to 0 as the segment-fill loop does not execute for zero-segment wire payloads. 4) The transport layer invokes svc_rdma_get_inv_rkey() to handle Send-With-Invalidate operations. 5) The macro calculates an invalid memory address due to the underflow, leading to an out-of-bounds read when accessing rs_handle. 6) The CPU encounters a memory access violation, triggering a General Protection Fault and a subsequent kernel panic.\nThe component affected is primarily located in net/sunrpc/xprtrdma/svc_rdma_recvfrom.c and net/sunrpc/xprtrdma/svc_rdma_rw.c. The vulnerability persists until the iteration logic is transitioned to a half-open boundary condition using ch_segcount directly, which safely handles the zero-segment case by terminating the loop immediately without executing the body.\nThis vulnerability is reachable remotely without authentication, provided the RPC-over-RDMA transport is enabled and Send-With-Invalidate has been negotiated. The post-exploitation impact includes kernel-level denial of service and the potential for reading arbitrary kernel memory addresses during the iteration walk, potentially leaking sensitive data to the attacker."
}