The Linux kernel's RDMA RTRS server used the length field from a remote peer's descriptor directly without properly bounding it against the maximum chunk size. This allowed an attacker controlling the descriptor length to cause an RDMA write operation to read beyond the mapped memory chunk. Depending on the IOMMU configuration, this could lead to disclosure of adjacent host memory or connection termination due to faults. The fix enforces a check rejecting descriptor lengths larger than the maximum chunk size, aligning with existing bounds on other parameters.

A remote peer could exploit this vulnerability to read memory beyond the intended buffer, potentially disclosing sensitive host memory contents if the IOMMU is not configured to prevent such accesses. Alternatively, the connection may be aborted if the IOMMU blocks out-of-range accesses. This behavior violates protocol constraints and is driven by attacker-controlled input.

A patch is available that rejects descriptor lengths exceeding the maximum chunk size, preventing out-of-bounds RDMA read operations. Users should apply the official Linux kernel update that includes this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.