The Linux kernel DRBD module's recv_dless_read() function improperly handles peer-supplied payload lengths in P_DATA_REPLY messages. The payload length is received as a signed int data_size, which can become negative due to two peer-controlled inputs: underflow after digest length subtraction or casting a large unsigned length above INT_MAX to a negative signed int. This leads to a negative expect value in the bio receive loop, causing drbd_recv_all_warn() to receive data with a size_t of SIZE_MAX into the first mapped page, resulting in kernel memory corruption. The sibling receive path read_in_block() is unaffected as it uses unsigned size and bounds checks. The vulnerability allows a malicious or man-in-the-middle DRBD peer to corrupt kernel memory on nodes that read from peers, including diskless nodes or those using read-balancing, under default configurations without data-integrity algorithms.

A malicious or man-in-the-middle DRBD peer can exploit this vulnerability to cause kernel memory corruption on the receiving node by sending a data reply with a crafted payload size. This memory corruption can lead to system instability or potential escalation of privileges. Nodes configured to read from peers without data-integrity algorithms are vulnerable, including diskless nodes or those using read-balancing. The sibling receive path is not affected, limiting the scope to the vulnerable recv_dless_read() path.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configurations that allow untrusted peers to send data replies or enable data-integrity algorithms to mitigate the risk. Monitor vendor communications for patches addressing this vulnerability.