PT-2026-64490 · Linux · Linux
CVE-2026-64269
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma write sg
When the server answers an RTRS READ, rdma write sg() builds the source
scatter/gather entry for the IB WR RDMA WRITE that returns data to the
peer. Its length is taken directly from the wire descriptor:
plist->length = le32 to cpu(id->rd msg->desc[0].len);
rd msg points into the chunk buffer that the remote peer filled via
RDMA-WRITE-WITH-IMM (rtrs srv rdma done() -> process io req() ->
process read()), so desc[0].len is attacker-controlled and, before this
change, was only rejected when zero. The source address is the fixed
chunk start (dma addr[msg id]) and the source lkey is the PD-wide
local dma lkey, which is not tied to the chunk's MR mapping, so the verbs
layer does not constrain the transfer length to max chunk size. msg id
and off are bounded against queue depth and max chunk size in
rtrs srv rdma done(), but desc[0].len is a separate field that was not
checked against the chunk size.
A peer that advertises desc[0].len larger than max chunk size can make
the posted RDMA write read past the chunk's mapped region. The resulting
behaviour depends on the IOMMU configuration: with no IOMMU or in
passthrough mode the read may extend into memory adjacent to the chunk
and be returned to the peer, which can disclose host memory; with a
translating IOMMU the out-of-range access is expected to fault and abort
the connection. In either case the transfer exceeds what the protocol
permits and is driven by a remote peer.
Reject a descriptor length above max chunk size, mirroring the existing
off >= max chunk size bound in rtrs srv rdma done(). Legitimate clients
do not exceed it: the client sets desc[0].len to its MR length, which is
capped at the negotiated max io size (max chunk size - MAX HDR SIZE).
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux