The Linux kernel svcrdma module had a vulnerability where an RPC-over-RDMA client could request a reply without providing necessary Write list or Reply chunk structures. When the reply required more scatter/gather entries than the device's Send Queue supports, the kernel linearized the reply into a fixed-size buffer (sc_max_req_size). However, the reply size was only bounded by the client's request, allowing svc_rdma_xb_linearize() to copy data beyond the buffer's end, corrupting adjacent slab memory and causing the device to read beyond the mapped region. The fix involved changing svc_rdma_pull_up_needed() to report an error (-E2BIG) when the reply is too large to fit, failing the request per RFC 8166 guidance instead of dropping the connection. The function was renamed to svc_rdma_check_pull_up() to reflect its new behavior.

This vulnerability could cause memory corruption in the kernel due to buffer overflow, potentially leading to system instability or crashes. The device could also read beyond mapped memory regions, which might cause undefined behavior. There is no indication of remote code execution or privilege escalation from the provided data. No known exploits in the wild have been reported.

A fix is available that changes the pull-up logic to reject replies that exceed the buffer size, preventing overflow. Users should apply the official Linux kernel patches that implement this fix. Since no patch links are provided here, consult the Linux kernel vendor advisory or mainline kernel updates for the corrected versions. No additional mitigation is indicated.