CVE-2026-97413

Received Received - Intake

Integer Underflow in Linux Kernel RDMA/rtrs-srv

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write usr_len is read from a network-supplied message field (le16_to_cpu) and used to compute data_len = off - usr_len without validating that usr_len <= off. A malicious RDMA client can send usr_len > off causing an integer underflow, resulting in data_len wrapping to a huge size_t value which is then passed to the rdma_ev callback as a memory length, leading to out-of-bounds memory access. Fix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids() in both process_read() and process_write(), ensuring the early return path acquires no reference and has no resource leak.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97413

EUVD

EUVD-2026-86026

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is an integer underflow vulnerability in the Linux kernel's RDMA subsystem. A malicious client can send a crafted message where the user length (usr_len) exceeds the offset (off). This causes an integer underflow when calculating data_len = off - usr_len, making data_len wrap to a very large value. This large value is then passed as a memory length to a callback function, leading to out-of-bounds memory access.

Detection Guidance

This vulnerability involves an integer underflow in the Linux kernel's RDMA/rtrs-srv module. Detection requires checking for unusual network traffic patterns or kernel logs related to RDMA operations. Monitor for crashes or memory corruption in RDMA services. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker with access to the RDMA subsystem to cause a denial of service by crashing the system or potentially execute arbitrary code with kernel privileges. It may also lead to data corruption or unauthorized access to sensitive information if exploited successfully.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level memory corruption issue in the Linux kernel's RDMA subsystem. Compliance impacts would only occur if the vulnerability were exploited to access or leak sensitive data, which is not described in the provided context.

Mitigation Strategies

Apply the Linux kernel patch that fixes the integer underflow in RDMA/rtrs-srv. Update to a patched kernel version. If immediate patching is not possible, restrict RDMA access to trusted networks or disable RDMA services until patched.

Hi! I’m here to help you understand CVE-2026-97413. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70