Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write usr_len is read from a network-supplied message field (le16_to_cpu) and used to compute data_len = off - usr_len without validating that usr_len <= off. A malicious RDMA client can send usr_len > off causing an integer underflow, resulting in data_len wrapping to a huge size_t value which is then passed to the rdma_ev callback as a memory length, leading to out-of-bounds memory access. Fix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids() in both process_read() and process_write(), ensuring the early return path acquires no reference and has no resource leak.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-24T17:17:18.990Z",
  "pubdate": "2026-09-24T17:17:18.990Z",
  "executiveSummary": "The RDMA/rtrs-srv component of the Linux kernel is susceptible to an integer underflow vulnerability caused by improper validation of network-supplied input.\nThe vulnerability arises when the 'usr_len' field, parsed from an RDMA client message, is not checked against the 'off' offset value prior to calculating 'data_len'.\nA malicious remote client can exploit this flaw by providing a 'usr_len' value greater than 'off', leading to an integer underflow that results in an excessively large value for 'data_len'.\nThis manipulated size is subsequently passed to the 'rdma_ev' callback, triggering an out-of-bounds (OOB) memory access.\nThe impact includes potential memory corruption, information disclosure, or system instability, typically resulting in a kernel panic.\nExploitation requires the attacker to have established an RDMA connection to the target server, allowing for the transmission of specially crafted network packets.\nThis vulnerability highlights the risks associated with trusting remote input in kernel-space memory management routines, necessitating strict bounds checking for all network-supplied protocol headers.",
  "technicalDetails": "The vulnerability resides within the RDMA/rtrs-srv (RDMA Transport Server) subsystem of the Linux kernel, specifically impacting the 'process_read' and 'process_write' functions.\nThe root cause is an improper handling of the 'usr_len' field. The kernel reads 'usr_len' directly from a network-supplied message using 'le16_to_cpu' to convert the little-endian integer. This value is then used in the arithmetic operation 'data_len = off - usr_len'.\nBecause there is no validation to ensure that 'usr_len <= off', a malicious actor can craft an RDMA message where 'usr_len' exceeds 'off'. In C, when 'usr_len' is subtracted from 'off', the resulting value wraps around due to integer underflow, producing a massive 'size_t' value.\nThe attack flow proceeds as follows: First, the attacker initiates an RDMA session with the target rtrs-srv. Second, the attacker sends an RDMA READ or WRITE request containing a malformed message header where the 'usr_len' field is set to a value numerically larger than the current 'off' offset. Third, the kernel processes the message in 'process_read' or 'process_write', failing to perform the necessary bounds check. Fourth, the arithmetic underflow occurs, creating an extremely large 'data_len'. Finally, the system passes this incorrect 'data_len' to the 'rdma_ev' callback, which proceeds to perform memory operations (such as data movement or buffer management) using the massive length value. This causes the operation to read or write well beyond the intended buffer, resulting in out-of-bounds memory access.\nThe post-exploitation impact is severe. Since this occurs within the kernel, an out-of-bounds write could potentially overwrite critical kernel structures, leading to privilege escalation or arbitrary code execution, while an out-of-bounds read could lead to the leakage of sensitive kernel memory content. In most cases, the resulting invalid memory access will immediately trigger a system crash (kernel oops/panic), providing a mechanism for a remote denial-of-service (DoS) attack.\nThe vulnerability is fixed by implementing a validation step that verifies 'usr_len <= off' before invoking 'rtrs_srv_get_ops_ids'. This ensures that any malformed requests are dropped safely without leaking resources or proceeding to invalid memory operations."
}