CVE-2026-90307

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A heap information leak exists in the RDMA/srp component. The srp recv done() function fails to pass the received byte length to srp process cred req() and srp process aer req(), which then read fixed-size fields from the receive buffer without verifying if those fields were actually received. Because the buffer size max ti iu len is not validated, a malicious target can trigger an out-of-bounds read by sending a truncated SRP CRED REQ or SRP AER REQ. This allows the target to read data beyond the buffer end, specifically the tag and lun variables, which are then copied into the response and sent back to the target. A similar issue occurs in srp process rsp() regarding rsp->data[3]. This results in a leak of 8 bytes per response from the slab cache.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.