In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs-srv: Fix integer underflow in process read and process write

usr len is read from a network-supplied message field (le16 to cpu) and used to compute data len = off - usr len without validating that usr len <= off. A malicious RDMA client can send usr len > off causing an integer underflow, resulting in data len wrapping to a huge size t value which is then passed to the rdma ev callback as a memory length, leading to out-of-bounds memory access.

Fix by reading and validating usr len <= off before rtrs srv get ops ids() in both process read() and process write(), ensuring the early return path acquires no reference and has no resource leak.