EUVD-2026-59541
GHSA-f87m-vg23-g294
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Overflow is triggered pre-auth over the RDMA fabric with a single crafted length (AV:N/AC:L/PR:N/UI:N); kernel memory corruption supports H/H/H, though real reachability is gated by the non-default ib_srpt target being configured.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: fix integer overflow in immediate data length check
imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one().
Use check_add_overflow() to detect wrapping before the comparison.
AnalysisAI
Kernel-level memory corruption in the Linux RDMA SCSI RDMA Protocol target driver (ib_srpt) lets a malicious SRP initiator on the RDMA fabric overflow an integer length calculation and drive a ~4GB out-of-bounds scatter-gather mapping. The flaw stems from adding an attacker-controlled 32-bit immediate-data length to an offset without overflow checking, wrapping req_size below its bounds check. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target host to have the RDMA SRP target driver (ib_srpt) loaded and an SRP target configured/exported, and the attacker must be able to act as an SRP initiator on the same InfiniBand/RoCE RDMA fabric to send a command with attacker-chosen immediate-data length (imm_buf->len = 0xFFFFFFFF). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are sharply divergent and should be weighed together rather than trusting the headline number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with the ability to act as an SRP initiator on a shared InfiniBand/RoCE fabric connects to a host running the ib_srpt target and issues an SRP command carrying immediate data with len set to 0xFFFFFFFF. The oversized length wraps the size check and is passed to sg_init_one(), corrupting kernel memory and at minimum crashing the target (denial of service), with potential for further exploitation. … |
| Remediation | Vendor-released patch: upgrade to a fixed stable kernel - at minimum 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or mainline 7.2-rc1 as appropriate to your series, applying the specific check_add_overflow() commit from git.kernel.org/stable (see the commit list above) if you maintain a custom tree. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory Linux systems hosting RDMA SCSI targets and identify kernel versions currently deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today