The Linux kernel svcrdma module previously validated individual Read segment lengths but did not prevent a requester from sending multiple segments whose total length exceeded the rq_pages array budget. When one segment exactly fills the page array, the runtime guard in svc_rdma_build_read_segment() is bypassed because the length reaches zero. A subsequent segment then accesses the NULL sentinel slot at rq_pages[rq_maxpages], causing a NULL pointer dereference during DMA mapping. The fix involves accumulating pages across all Read segments and rejecting messages at decode time if the total would overflow the page budget.

This vulnerability can cause a NULL pointer dereference in the Linux kernel's svcrdma module, potentially leading to a denial of service (kernel crash). There is no information about code execution or privilege escalation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, monitoring for updates from the Linux kernel maintainers is recommended.