RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
Affects the Linux kernel's RDMA rtrs-srv server code from 5.8.0 onward, fixed in stable releases 5.15.222, 6.1.189, 6.6.158, 6.12.111 and 6.18.53.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's RDMA RTRS server component (rtrs-srv), which handles read and write requests from RDMA clients, is affected. A malicious remote client could send a crafted message that causes an integer underflow, potentially leading to out-of-bounds memory access on the server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write usr_len is read from a network-supplied message field (le16_to_cpu) and used to compute data_len = off - usr_len without validating that usr_len <= off. A malicious RDMA client can send usr_len > off causing an integer underflow, resulting in data_len wrapping to a huge size_t value which is then passed to the rdma_ev callback as a memory length, leading to out-of-bounds memory access. Fix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids() in both process_read() and process_write(), ensuring the early return path acquires no reference and has no resource leak.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 9cb837480424e78ed585376f944088246685aec3 · fixed in 6b1e26e70d7ca9f0906af2283558a530eeb1f066; From 9cb837480424e78ed585376f944088246685aec3 · fixed in 2c52b2afded988233cd4ccc185cf5147bbc77a76; From 9cb837480424e78ed585376f944088246685aec3 · fixed in b042b4947752df0b3d16e683ac09fb4f7f0e33e0; From 9cb837480424e78ed585376f944088246685aec3 · fixed in 24ad03bfeda05fca04c56677e57fd3d6bc3e9978; From 9cb837480424e78ed585376f944088246685aec3 · fixed in c76e9123ab91a903396d26e6ab1b5caae5c6b149; From 9cb837480424e78ed585376f944088246685aec3 · fixed in 54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5
- Linux Linux
5.8
- KernelLinux
From 5.8.0 · fixed in 5.15.222; From 5.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53
References 6
git.kernel.org
Questions about CVE-2026-97413
What does this mean?
An integer underflow in the RTRS server's process_read and process_write functions can make a computed data length wrap around to a huge value. The kernel can then access memory outside the intended bounds.Source: git.kernel.org
Am I affected, and how do I check?
The affected range runs from kernel 5.8.0 up to the fixed release for each branch: 5.15.222, 6.1.189, 6.6.158, 6.12.111 or 6.18.53. To check a system, run uname -r and compare the version with the fix for its branch, keeping in mind the bug is in the rtrs-srv RDMA code path.Source: git.kernel.org
What should I do about it?
Update to the fixed stable kernel for your branch: 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53, or a later release.Source: git.kernel.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data