The Linux kernel's IB/isert iSCSI RDMA transport implementation in isert_recv_done() does not validate that the declared data segment length in a Protocol Data Unit (PDU) matches the actual bytes received (wc->byte_len). Handlers such as isert_handle_iscsi_dataout() and isert_handle_scsi_cmd() copy data based on the declared length without bounds checking, enabling an initiator to cause out-of-bounds reads of the receive buffer. Additionally, when immediate data length equals the declared data length, the vulnerability can cause heap contents beyond the receive descriptor to be written to the backend storage. The vulnerability arises because the negotiated maximum data segment length is not clamped to the fixed receive descriptor size, allowing an initiator to raise its own ceiling. The fix involves validating wc->byte_len against the declared length before processing the PDU and rejecting connections if the check fails.

An attacker controlling an iSCSI initiator can send PDUs with declared data lengths larger than the actual received data, causing the Linux kernel to perform out-of-bounds reads and potentially write unintended data to backend storage. This can lead to information disclosure and data corruption. The vulnerability has a CVSS score of 9.1, indicating critical severity with high confidentiality impact and high availability impact. No known exploits in the wild have been reported.

A fix is available that validates the actual received byte length against the declared data segment length in isert_recv_done() before handing the PDU to opcode handlers. Connections are reinstated if the PDU is shorter than expected, preventing out-of-bounds reads. Users should apply the official Linux kernel patches that address this validation. Patch status is not explicitly stated in the input but the vulnerability is described as resolved, indicating an official fix is available.