Skip to main content

Linux Kernel CVE-2025-68811

CRITICAL
2026-01-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Reachable only over an RDMA fabric (AV:A) via a non-default NFS-RDMA export and crafted inline chunks (AC:H); no NFS auth at transport (PR:N); OOB access yields disclosure, corruption, and crash.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.1 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jul 30, 2026 - 06:44 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
9.8 (CRITICAL)
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 13, 2026 - 16:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: use rc_pageoff for memcpy byte offset

svc_rdma_copy_inline_range added rc_curpage (page index) to the page base instead of the byte offset rc_pageoff. Use rc_pageoff so copies land within the current page.

Found by ZeroPath (https://zeropath.com)

AnalysisAI

Kernel memory corruption in the Linux svcrdma transport (server-side NFS-over-RDMA) arises because svc_rdma_copy_inline_range() added the page index (rc_curpage) instead of the byte offset (rc_pageoff) when computing the memcpy destination, so inline payload copies land at the wrong location within the receive pages. On systems exporting NFS over RDMA, a client on the RDMA fabric can drive copies that miscalculate their target offset, leading to out-of-bounds reads/writes in kernel page memory and potential information disclosure or corruption. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and the issue is not in CISA KEV, but distro fixes (Ubuntu USN-8177-1) and upstream stable commits are available.

Technical ContextAI

The flaw lives in the kernel's svcrdma layer, the RPC-over-RDMA server transport used by the in-kernel NFS server (nfsd) when clients mount exports using the 'rdma' protocol over InfiniBand/RoCE/iWARP fabrics. svc_rdma_copy_inline_range() reassembles inline chunk data received from an RDMA client into a set of receive pages; each page has a running byte offset tracked by rc_pageoff and a page index tracked by rc_curpage. The bug used rc_curpage (a small integer page index, e.g. 0,1,2...) as the intra-page byte offset for memcpy instead of rc_pageoff, so the destination pointer is computed as page_base + page_index rather than page_base + byte_offset. This is a classic incorrect-pointer-arithmetic / out-of-bounds access class (conceptually CWE-787 out-of-bounds write and/or CWE-125 out-of-bounds read); the input marks CWE as N/A, so the root-cause class is inferred from the patch description rather than an assigned CWE. The three git.kernel.org stable commit hashes indicate the fix was backported across multiple stable branches.

Affected ProductsAI

The affected product is the Linux kernel, specifically the svcrdma (RPC-over-RDMA server) code within the in-kernel NFS server. Exact vulnerable and fixed version ranges are not enumerated in the provided NVD data (no CPE strings supplied); affected releases must be inferred from the three upstream stable fix commits (git.kernel.org/stable/c/2a77c8dd49bccf0ca232be7c836cec1209abb8da, /a8ee9099f30654917aa68f55d707b5627e1dbf77, /e8623e9c451e23d84b870811f42fd872b4089ef6), which indicate the bug spans multiple maintained stable branches. Ubuntu has published fixed packages via USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1), and additional advisory context is at VulDB (https://vuldb.com/?id.340685). Only systems whose kernel has NFS-over-RDMA server support compiled and configured to export over RDMA are exposed.

RemediationAI

Apply the vendor kernel update: on Ubuntu, install the fixed kernel packages from USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) and reboot; on other distributions, upgrade to a kernel that includes the upstream stable fix commits (git.kernel.org/stable/c/2a77c8dd49bccf0ca232be7c836cec1209abb8da and the two companion backports 2a77c8dd/a8ee9099/e8623e9c). Because these references are stable commits and a distro USN rather than a single upstream tagged release, treat the fix as 'upstream commits available plus Ubuntu-released patch' and confirm the exact patched package version for your distribution. If patching cannot be done immediately, the most effective compensating control is to stop exporting NFS over RDMA: unload/disable the svcrdma server transport or serve those exports over TCP instead (trade-off: loss of RDMA performance benefits for NFS clients). Failing that, restrict RDMA fabric access to trusted hosts only (e.g., isolate the InfiniBand/RoCE network, enforce host-based access controls on nfsd exports), accepting that this reduces but does not eliminate risk from a compromised or malicious fabric peer.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed

Share

CVE-2025-68811 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy