CVE-2026-90307

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ

srp_recv_done() passes wc->byte_len to srp_process_rsp(). It passes

nothing to srp_process_cred_req() and srp_process_aer_req(), which read

fixed-size fields from the receive buffer without checking that those

fields were received.

The buffer size is max_ti_iu_len, which comes from the login response

and is not validated. A target that advertises 8 and then sends an

8-byte SRP_CRED_REQ makes the initiator read req->tag from beyond the

end of the buffer. req->tag is copied into the SRP_CRED_RSP and sent

back, so those bytes reach the target. SRP_AER_REQ behaves the same way

and also reads req->lun.

The leak is 8 bytes per response. max_ti_iu_len also decides which slab

cache the buffer comes from. With 8 the buffer is a kmalloc-8 object and

the read is entirely outside it:

BUG: KASAN: slab-out-of-bounds in srp_recv_done+0x172b/0x1aa0

Read of size 8

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References