The Linux kernel svcrdma module's svc_rdma_read_chunk_range() function contained two arithmetic defects in its per-segment loop that processed Read chunk segments. First, it used a '>' comparison instead of '>=' to skip fully consumed segments, causing underflow in dummy.rs_length when offset equaled segment length. Second, the length calculation subtracted offset after applying the minimum cap, leading to incorrect segment length and potential underflow. These defects could cause a large number of buffer vectors (nr_bvec) and trigger large memory allocations in svc_rdma_build_read_segment() and svc_rdma_get_rw_ctxt(). Additionally, the function did not handle zero-length requests properly, rejecting valid requests. The patch corrected the comparison to '>=' to skip fully consumed segments, moved the '- offset' inside the min_t() call to cap the residual length correctly, returned success immediately for zero-length requests, and stopped iteration once the requested range was fulfilled.

The vulnerability could cause incorrect memory allocation sizes due to underflow and arithmetic errors when processing RDMA Read chunks, potentially leading to excessive memory consumption or kernel instability. However, no known exploits in the wild have been reported. The issue affects the Linux kernel's svcrdma component handling RDMA requests.

A fix is available that corrects the offset arithmetic and boundary checks in svc_rdma_read_chunk_range(). Users should apply the official Linux kernel patches that address this issue. No additional mitigation is required once the patch is applied.