CVE-2026-64269

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

When the server answers an RTRS READ, rdma_write_sg() builds the source

scatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the

peer. Its length is taken directly from the wire descriptor:

plist->length = le32_to_cpu(id->rd_msg->desc[0].len);

rd_msg points into the chunk buffer that the remote peer filled via

RDMA-WRITE-WITH-IMM (rtrs_srv_rdma_done() -> process_io_req() ->

process_read()), so desc[0].len is attacker-controlled and, before this

change, was only rejected when zero. The source address is the fixed

chunk start (dma_addr[msg_id]) and the source lkey is the PD-wide

local_dma_lkey, which is not tied to the chunk's MR mapping, so the verbs

layer does not constrain the transfer length to max_chunk_size. msg_id

and off are bounded against queue_depth and max_chunk_size in

rtrs_srv_rdma_done(), but desc[0].len is a separate

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References