CVE-2026-64269

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the RDMA/rtrs-srv component where the rdma write sg() function fails to validate the length of the RDMA-Write operation against the maximum chunk size. When responding to an RTRS READ, the server uses a length value taken directly from the wire descriptor desc[0].len, which is controlled by the remote peer. Because the source lkey is not tied to the chunk's Memory Region (MR) mapping, the verbs layer does not restrict the transfer length. A remote peer can specify a desc[0].len larger than the max chunk size, potentially causing the system to read memory adjacent to the chunk. Depending on the IOMMU (Input-Output Memory Management Unit) configuration, this can lead to the disclosure of host memory or cause the connection to fault and abort.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.