The Linux kernel svcrdma module had a vulnerability where the macro pcl_for_each_segment computed an inclusive upper bound using ch_segcount - 1, which underflows to 0xFFFFFFFF when ch_segcount is zero. This causes the loop to access memory beyond the ch_segments array, resulting in an out-of-bounds read and a general protection fault. The vulnerability is reachable from the wire due to zero-segment chunks being accepted and linked before segment filling. The fix changes the macro to use a half-open upper bound that correctly handles zero-segment chunks by skipping the loop body, thus preventing the out-of-bounds access.

This vulnerability can cause a general protection fault (kernel crash) due to out-of-bounds memory access in the svcrdma kernel module when processing certain network chunks with zero segments. It affects kernel stability but there is no explicit information about remote code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel svcrdma module by adjusting the iteration bounds in pcl_for_each_segment to correctly handle zero-segment chunks. Users should apply the official kernel update that includes this fix once available. Patch status is not yet confirmed; check the vendor advisory for current remediation guidance.