CVE-2026-97413 (GCVE-0-2026-97413)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:03 – Updated: 2026-09-25 05:10
VLAI
Title
RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write usr_len is read from a network-supplied message field (le16_to_cpu) and used to compute data_len = off - usr_len without validating that usr_len <= off. A malicious RDMA client can send usr_len > off causing an integer underflow, resulting in data_len wrapping to a huge size_t value which is then passed to the rdma_ev callback as a memory length, leading to out-of-bounds memory access. Fix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids() in both process_read() and process_write(), ensuring the early return path acquires no reference and has no resource leak.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 24ad03bfeda05fca04c56677e57fd3d6bc3e9978 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c76e9123ab91a903396d26e6ab1b5caae5c6b149 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5 (git)
Affected: 0 , < 6.12.111 (semver)
Affected: 0 , < 6.18.53 (semver)
guessed Create a notification for this product.
Linux Linux Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/rtrs/rtrs-srv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24ad03bfeda05fca04c56677e57fd3d6bc3e9978",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c76e9123ab91a903396d26e6ab1b5caae5c6b149",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.111",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.53",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/rtrs/rtrs-srv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Fix integer underflow in process_read and process_write\n\nusr_len is read from a network-supplied message field (le16_to_cpu)\nand used to compute data_len = off - usr_len without validating that\nusr_len \u003c= off. A malicious RDMA client can send usr_len \u003e off causing\nan integer underflow, resulting in data_len wrapping to a huge size_t\nvalue which is then passed to the rdma_ev callback as a memory length,\nleading to out-of-bounds memory access.\n\nFix by reading and validating usr_len \u003c= off before rtrs_srv_get_ops_ids()\nin both process_read() and process_write(), ensuring the early return\npath acquires no reference and has no resource leak."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote peer RDMA-WRITE-WITH-IMM\u0027s a RTRS_MSG_READ or RTRS_MSG_WRITE carrying attacker-controlled usr_len; rtrs_srv_rdma_done() hands that buffer to process_io_req() then process_read()/process_write(). rtrs_srv_cm_init() listens with RDMA_PS_TCP on IPv6 port 1234 (RoCEv2/iWARP), which is IP-routable.\nAC:L - The peer sets le16 usr_len in the RTRS_MSG_READ/WRITE at chunk+off and the IMM payload that rtrs_srv_rdma_done() splits into msg_id and off. Choosing usr_len \u003e off makes size_t data_len = off - usr_len wrap on every call; there is no race and no victim-held state.\nPR:N - rtrs_rdma_connect() admits the RDMA_CM CONNECT_REQUEST after checking only RTRS_MAGIC, protocol major version, and cid/uuid; process_info_req() then publishes chunk rkeys and moves to RTRS_SRV_CONNECTED with no credentials, so process_read()/process_write() run unauthenticated.\nUI:N - The attacker posts the RDMA-WRITE-WITH-IMM that rtrs_srv_rdma_done() delivers to process_read()/process_write(); no local user must mount a volume, open a file, or otherwise interact.\nS:U - process_read()/process_write() invoke rnbd_srv_rdma_ev() in the same host kernel that owns the chunk pages; the OOB access stays inside that kernel and does not escape a VM, guest, or IOMMU domain.\nC:H - Underflowed data_len makes usr = page_address(chunk)+off-usr_len point before the chunk. rnbd_srv_rdma_ev() reads the RNBD header there; a sprayed RNBD_MSG_OPEN does unbounded strlen(dev_name), and process_rdma() bio_add_virt_nofail()s a ~4GiB WRITE bvec that copies following linear-map pages onto a device the peer can read back.\nI:H - process_rdma() truncates the wrapped size_t to u32 and bio_add_virt_nofail() installs a ~4GiB bvec from the chunk page; submit_bio() of an RNBD_OP_READ therefore writes device data through that bvec into subsequent kernel linear-map pages, an out-of-bounds kernel write.\nA:H - rnbd_srv_rdma_ev() immediately loads hdr-\u003etype from the wrapped usr pointer, process_msg_open() strlen()s that OOB name, and the ~4GiB bio_add_virt_nofail() bvec walks into holes or MMIO in the linear map; any of those oops/panic the completion path and can be repeated at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:10:26.459Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24ad03bfeda05fca04c56677e57fd3d6bc3e9978"
        },
        {
          "url": "https://git.kernel.org/stable/c/c76e9123ab91a903396d26e6ab1b5caae5c6b149"
        },
        {
          "url": "https://git.kernel.org/stable/c/54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5"
        }
      ],
      "title": "RDMA/rtrs-srv: Fix integer underflow in process_read and process_write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97413",
    "datePublished": "2026-09-24T16:03:21.010Z",
    "dateReserved": "2026-09-24T14:53:16.867Z",
    "dateUpdated": "2026-09-25T05:10:26.459Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/ulp/rtrs/rtrs-srv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "24ad03bfeda05fca04c56677e57fd3d6bc3e9978",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c76e9123ab91a903396d26e6ab1b5caae5c6b149",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.12.111",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.53",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/ulp/rtrs/rtrs-srv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Fix integer underflow in process_read and process_write\n\nusr_len is read from a network-supplied message field (le16_to_cpu)\nand used to compute data_len = off - usr_len without validating that\nusr_len \u003c= off. A malicious RDMA client can send usr_len \u003e off causing\nan integer underflow, resulting in data_len wrapping to a huge size_t\nvalue which is then passed to the rdma_ev callback as a memory length,\nleading to out-of-bounds memory access.\n\nFix by reading and validating usr_len \u003c= off before rtrs_srv_get_ops_ids()\nin both process_read() and process_write(), ensuring the early return\npath acquires no reference and has no resource leak."
          }
        ],
        "id": "CVE-2026-97413",
        "lastModified": "2026-09-24T17:17:18.990",
        "metrics": {},
        "published": "2026-09-24T17:17:18.990",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/24ad03bfeda05fca04c56677e57fd3d6bc3e9978"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c76e9123ab91a903396d26e6ab1b5caae5c6b149"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-09-24T23:46:40Z",
      "cve": "CVE-2026-97413",
      "id": "CVE-2026-97413",
      "initial_release_date": "2026-09-24T23:46:40Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-97413",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-97413.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.