security update for kernel

The vulnerability exists in the Linux kernel's soft-iWARP RDMA driver where the MPA FPDU length field (mpa_len) can be set by a peer to a value smaller than the fixed DDP/RDMAP header length for the opcode. This causes a signed integer underflow in the calculation of remaining FPDU parts, which then propagates through various functions leading to a large unsigned read during skb_copy_bits(). This can result in a use-after-free bug and potentially reading out-of-bounds kernel memory. The fix adds an invariant check to reject FPDUs with mpa_len values below the protocol-defined minimum, terminating the connection with the appropriate RFC 5044 framing error code.

A malicious connected siw peer can cause a kernel use-after-free and out-of-bounds read by sending malformed iWARP FPDUs with invalid length fields. This may lead to kernel memory disclosure or instability. There is no indication of remote code execution or privilege escalation from the provided data. No known exploits in the wild have been reported.

A fix is available that adds a protocol-compliant length check rejecting malformed FPDUs early and terminating the connection on error. Users should apply the official kernel security update from the SUSE Product Security Team or their Linux distribution vendor to remediate this issue. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.