All vulnerabilities
CVE-2026-97413

Linux: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.50%Chance of exploitation activity in the next 30 days, higher than 42% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6b1e26e70d7ca9f0906af2283558a530eeb1f066Also 2c52b2afded988233cd4ccc185cf5147bbc77a76, 24ad03bfeda05fca04c56677e57fd3d6bc3e9978 and 1 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 6b1e26e70d7ca9f0906af2283558a530eeb1f066LinuxCVE List
  • 2c52b2afded988233cd4ccc185cf5147bbc77a76LinuxCVE List
  • 24ad03bfeda05fca04c56677e57fd3d6bc3e9978LinuxCVE List
  • 54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs-srv: Fix integer underflow in process_read and process_write

usr_len is read from a network-supplied message field (le16_to_cpu) and used to compute data_len = off - usr_len without validating that usr_len <= off. A malicious RDMA client can send usr_len > off causing an integer underflow, resulting in data_len wrapping to a huge size_t value which is then passed to the rdma_ev callback as a memory length, leading to out-of-bounds memory access.

Fix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids() in both process_read() and process_write(), ensuring the early return path acquires no reference and has no resource leak.

Text from CVE List

Affected versions 14

  • Linuxaffected: 9cb837480424e78ed585376f944088246685aec3 before 6b1e26e70d7ca9f0906af2283558a530eeb1f066CVE List
  • Linuxaffected: 9cb837480424e78ed585376f944088246685aec3 before 2c52b2afded988233cd4ccc185cf5147bbc77a76CVE List
  • Linuxaffected: 9cb837480424e78ed585376f944088246685aec3 before b042b4947752df0b3d16e683ac09fb4f7f0e33e0CVE List
  • Linuxaffected: 9cb837480424e78ed585376f944088246685aec3 before 24ad03bfeda05fca04c56677e57fd3d6bc3e9978CVE List
  • Linuxaffected: 9cb837480424e78ed585376f944088246685aec3 before c76e9123ab91a903396d26e6ab1b5caae5c6b149CVE List
  • Linuxaffected: 9cb837480424e78ed585376f944088246685aec3 before 54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5CVE List
  • Linuxaffected: 5.8CVE List
  • Linuxunaffected: all versions before 5.8CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 6