The Linux kernel's siw RDMA driver (infiniband/sw/siw/siw_qp_rx.c) improperly handles the placement of inbound Read Response DDP segments by accumulating processed lengths without verifying the total against the sink buffer length on continuation segments. While initial fragment validation occurs, subsequent segments can cause wqe->processed to exceed the validated buffer size, resulting in out-of-bounds writes at sge->laddr + wqe->processed. This vulnerability can be triggered by a remote connected siw peer over an established RDMA connection without requiring local privileges. The fix involves bounding every segment before placement and terminating the connection with a DDP error if an overrun would occur.

A remote attacker with an established RDMA connection can cause out-of-bounds memory writes in kernel space by sending malicious Read Response segments that exceed the requested length. This could lead to memory corruption, potential kernel crashes, or other undefined behavior. No local privileges are required, but the attacker must be a connected RDMA peer.

A fix is available that bounds each Read Response segment before placement and terminates connections that would cause buffer overruns. Users should apply the official Linux kernel patches that address this vulnerability. Patch status is not yet confirmed in this data; check the vendor advisory for current remediation guidance.