CVE-2026-97413 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
usr_len is read from a network-supplied message field (le16_to_cpu) and used to compute data_len = off - usr_len without validating that usr_len <= off. A malicious RDMA client can send usr_len > off causing an integer underflow, resulting in data_len wrapping to a huge size_t value which is then passed to the rdma_ev callback as a memory length, leading to out-of-bounds memory access.
Fix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids() in both process_read() and process_write(), ensuring the early return path acquires no reference and has no resource leak.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel contains a critical vulnerability within the RDMA/rtrs-srv subsystem that stems from insufficient validation of network-supplied input data during read and write operations. This flaw specifically affects the process_read and process_write functions, where the variable usr_len is extracted directly from a message field received over the network using le16_to_cpu conversion without any prior bounds checking against the offset value off. The core technical issue arises when an attacker crafts a malicious RDMA client request that sets usr_len to a value greater than off. In such scenarios, the subsequent calculation of data_len = off - usr_len results in an integer underflow because unsigned arithmetic wraps around rather than producing a negative result. This mathematical error causes data_len to wrap into a massive size_t value, which is then erroneously passed as a memory length parameter to the rdma_ev callback function.
The operational impact of this vulnerability is severe, primarily manifesting as out-of-bounds memory access within the kernel space. By supplying an excessively large buffer length derived from the underflowed data_len, a malicious actor can trigger unauthorized reads or writes beyond the intended memory boundaries. This type of flaw typically falls under CWE-190 Integer Overflow or Wraparound and is closely related to CWE-787 Out-of-bounds Write if the operation involves writing, or CWE-125 Out-of-bounds Read if it involves reading. From a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability aligns with techniques involving exploitation of remote services for arbitrary code execution or information disclosure, specifically leveraging improper input validation to bypass memory safety checks. The ability to trigger out-of-bounds access can lead to kernel panics, denial of service conditions due to system instability, or potentially privilege escalation if the attacker can control the data being read or written through these invalid pointers.
The resolution implemented in this fix addresses the root cause by introducing explicit validation logic before proceeding with resource acquisition and operation execution. Specifically, the patch ensures that usr_len is strictly validated against off within both process_read() and process_write functions prior to calling rtrs_srv_get_ops_ids(). This early return path not only prevents the integer underflow but also guarantees proper resource management by ensuring no references are acquired when invalid parameters are detected, thereby eliminating potential resource leaks associated with partial initialization. By enforcing that usr_len must be less than or equal to off before any significant processing occurs, the kernel effectively neutralizes the attack vector at its source. This defensive programming approach reinforces the principle of trusting only validated inputs from untrusted network sources and ensures that subsequent memory operations operate within safe, predictable boundaries defined by legitimate protocol constraints rather than attacker-controlled values.