The Linux kernel svcrdma subsystem had a vulnerability where the RPC/RDMA Read chunk position field, provided by remote clients, was stored without sufficient validation. The function xdr_count_read_segments() only checked 4-byte alignment but did not verify that positions were within the inline body length. This allowed, in single-chunk scenarios, splitting of kvecs at positions past the inline body, causing tail length underflow and exposure of adjacent slab memory. In multi-chunk scenarios, overlapping chunks caused unsigned subtraction underflows, and positions beyond the inline body caused underflows in gap length calculations. This led to svc_rdma_copy_inline_range() copying beyond the receive buffer into request pages, which are then returned to clients. The vulnerability was mitigated by adding bounds checks against the decoded inline RPC body, rejecting single chunks beyond the body and multi-chunk lists with excessive accumulated read bytes, and applying similar checks in call-chunk interleaving.

The vulnerability could allow a remote client to cause out-of-bounds memory reads or memory exposure by supplying crafted RPC/RDMA Read chunk positions. This could lead to exposure of adjacent kernel memory or copying beyond intended buffers, potentially compromising kernel memory integrity or causing denial of service. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to validate Read chunk positions before reconstruction. The fix bounds inline-range copies against the decoded inline RPC body and rejects invalid chunk positions and overlaps. Users should apply the official Linux kernel updates that include this patch. Since no vendor advisory or patch links are provided here, check the Linux kernel mailing lists or official repositories for the relevant patch and update accordingly.