The Linux kernel svcrdma RPC/RDMA Read list decoder previously stored wire-supplied segment lengths without validating their size. While 4-byte alignment was checked for non-zero positions, segment lengths were not capped, allowing oversized segments to reach svc_rdma_build_read_segment(). This function derived a large dynamic bvec allocation from the oversized length before verifying sufficient rq_pages remained. If a page-overrun guard triggered post-allocation, the newly acquired read/write context was not returned, causing a resource leak. The vulnerability was addressed by rejecting any segment whose length exceeds the receive context's page budget during Read list decoding, aligning with existing bounds on Write segments, and by returning the read/write context on overrun detection to maintain resource balance.

The vulnerability could lead to resource leaks in the Linux kernel's svcrdma RPC/RDMA subsystem due to oversized Read segments causing unbalanced memory allocations and failure to release resources properly. No information about exploitation or broader impact is provided.

A fix has been implemented in the Linux kernel to reject oversized Read segments during decoding and to ensure proper resource cleanup on overrun detection. Users should apply the official kernel update containing this fix. No additional mitigation actions are indicated.