Skip to main content

Linux Kernel CVE-2026-97413

| EUVDEUVD-2026-86026 CRITICAL
2026-09-24 Linux GHSA-wv45-qhgq-9h5f
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach rtrs-srv on RDMA fabric
  2. Delivery
    Establish RDMA client session
  3. Exploit
    Send message with usr_len > off
  4. Execution
    Trigger integer underflow in data_len
  5. Persist
    OOB memory access in rdma_ev callback
  6. Impact
    Kernel crash or memory corruption

Vulnerability Assessment

Exploitation Conditions

Requires the target Linux host to be running the rtrs-srv (RTRS server, used by RNBD RDMA network block device) module and to be reachable by the attacker over an RDMA/RoCE/InfiniBand fabric; the attacker must be able to establish an rtrs client session and send a process_read or process_write message. The single specific trigger is a message where the network-supplied usr_len field is greater than off, which underflows data_len. Limiting factors: rtrs-srv is not enabled or deployed on general-purpose systems (it is specific to RDMA storage/HPC environments), and the attacker needs RDMA-fabric connectivity to the vulnerable server rather than ordinary IP routing, substantially narrowing real-world reach despite the AV:N vector.
Impact

This is one of the more genuinely serious Linux kernel CVEs in the rtrs/RNBD family because the tainted value (usr_len) comes directly from a network-supplied RDMA message field (le16_to_cpu) rather than from firmware or an internal error path. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8 Critical) reflects unauthenticated remote reach against a listening rtrs-srv, and unlike the crash-dominant iwlwifi/HID siblings in my catalogue, that network reachability is plausible here. However, the 9.8 rating almost certainly overstates confirmed impact: the description only establishes 'out-of-bounds memory access' from data_len wrapping to a huge size_t, which is most reliably a crash/DoS and possibly an OOB read/write, not a demonstrated full C:H/I:H/A:H compromise. Countervailing signals: no EPSS score, no CISA KEV listing, and no public POC - exploitation requires an established RDMA session to a running rtrs-srv on an RDMA/RoCE fabric, which is a narrow, data-center/HPC/storage-specific attack surface. Net: a real fix-worthy remote memory-corruption bug, but the true priority is bounded by how rarely rtrs-srv is deployed, not by the headline 9.8. The CWE is listed as N/A but is really CWE-191 integer underflow leading to CWE-125/CWE-787 OOB access.
Exploit ScenarioDerived

An attacker who can reach a Linux host running the rtrs-srv (RNBD server) module over an RDMA/RoCE fabric establishes a session and sends a crafted read/write message whose usr_len field exceeds off. The subtraction data_len = off - usr_len underflows to a huge size_t, which is passed to the rdma_ev callback as a memory length, causing out-of-bounds memory access (crash and potential OOB read/write). No public exploit code is currently identified.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Out-of-bounds memory access in the Linux kernel's RDMA RTRS server (rtrs-srv) module, used by RNBD remote block devices, is reachable by an unauthenticated remote attacker (CVSS vector PR:N) who can open an rtrs client session over an RDMA/RoCE/InfiniBand fabric and send a process_read or process_write message whose network-supplied usr_len field exceeds off. The unchecked subtraction data_len = off - usr_len underflows to a huge size_t that is then handed to the rdma_ev callback as a memory length, producing the out-of-bounds access. The independent assessment rates this AV:N/AC:L/PR:N/UI:N/S:U with Low confidentiality and integrity impact and High availability impact (substantially below the vendor's 9.8), and practical exposure is narrowed because rtrs-srv is not present on general-purpose systems and requires RDMA-fabric reachability rather than ordinary IP routing; no public exploit code identified at time of analysis.

RemediationAI

Vendor-released patch: 6.12.111 (6.12.y), 6.18.53 (6.18.y), and 7.2 (mainline); apply the upstream stable commits 24ad03bfeda05fca04c56677e57fd3d6bc3e9978, c76e9123ab91a903396d26e6ab1b5caae5c6b149 and 54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5 from https://git.kernel.org/stable/c/ or update to the fixed kernel package for your distribution. If immediate kernel updates are not feasible, the most effective compensating control is to remove the attack surface entirely: if RNBD/RTRS remote block devices are not in use, unload the module (rmmod rtrs_srv) or blacklist it so it cannot be auto-loaded - trade-off is that RNBD volume export/import becomes unavailable on that host. Where RNBD is required, restrict who can reach it: bind RDMA-CM/RTRS listeners only to trusted RDMA fabric interfaces or a dedicated partition/VLAN, and enforce fabric-level access control (InfiniBand partition keys, RoCE VLAN/ACL segmentation, or rdma_cm-based peer allowlisting) so only known client HCA/GIDs can establish rtrs sessions - trade-off is added operational overhead and potential breakage of legitimate clients outside the allowed set. Note that the transport is reachable only over RDMA fabric connectivity, so segmenting the fabric meaningfully reduces exposure even before patching; there is no configuration toggle that repairs the underlying bounds check, so patching remains the definitive fix.

Affected VersionsENISA

Linux patch: 6.18.53
Linux 0 <6.18.53
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <c76e9123ab91a903396d26e6ab1b5caae5c6b149
Linux patch: 6.12.111
Linux patch: 7.2
Linux 0 <6.12.111
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <24ad03bfeda05fca04c56677e57fd3d6bc3e9978

Affected Packages

euvd linux fix: 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

RTRS (RDMA Transport) is the in-kernel transport used by RNBD (RDMA Network Block Device) to export block devices over RDMA, and rtrs-srv is its server endpoint. Both process_read() and process_write() parse client-supplied messages in which usr_len is read from the wire with le16_to_cpu() and then subtracted from a locally computed offset (data_len = off - usr_len). Because the code never verified usr_len <= off, a malicious client controls both sides of the subtraction; when usr_len > off the unsigned arithmetic underflows and data_len wraps to an enormous size_t that is propagated as a memory length into the rdma_ev callback, yielding an out-of-bounds access. The root-cause class is missing bounds validation leading to integer underflow (CWE-191) and consequent out-of-bounds memory access. The upstream fix relocates the read and adds validation of usr_len <= off before rtrs_srv_get_ops_ids() in both process_read() and process_write(), which matters beyond correctness: it guarantees the newly introduced early-return path acquires no reference and therefore introduces no resource leak. The affected code has existed since the original git import (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2), so essentially every kernel shipping the RTRS server is potentially in scope; CPE metadata lists the generic Linux kernel family (cpe:2.3:a:linux:linux:*).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 8.6 HIGH

Network-supplied field, no auth (PR:N) against a listening rtrs-srv; confirmed impact is a crash (A:H) with possible limited OOB read/write (C:L/I:L) rather than proven full compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 5.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
9.8 (CRITICAL)
Patch available
Sep 24, 2026 - 17:03 EUVD
CVE Published
Sep 24, 2026 - 16:03 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 24, 2026 - 16:03 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs-srv: Fix integer underflow in process_read and process_write

usr_len is read from a network-supplied message field (le16_to_cpu) and used to compute data_len = off - usr_len without validating that usr_len <= off. A malicious RDMA client can send usr_len > off causing an integer underflow, resulting in data_len wrapping to a huge size_t value which is then passed to the rdma_ev callback as a memory length, leading to out-of-bounds memory access.

Fix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids() in both process_read() and process_write(), ensuring the early return path acquires no reference and has no resource leak.

Articles & Coverage 1

News Critical Out-of-Bounds Memory Access in Linux Kernel RDMA RTRS Server - CVE-2026-97413 Sep 25, 2026

Executive ViewAI

Why It Matters

The Linux kernel's RDMA RTRS server (rtrs-srv) module, used by RNBD remote block devices, contains a critical out-of-bounds memory access that an unauthenticated attacker on an RDMA/RoCE/InfiniBand fabric can trigger to potentially crash or disrupt storage nodes. Organizations operating RDMA-enabled high-performance storage or compute clusters should care because exploitation can degrade availability of shared block storage, though no public exploit identified at time of analysis and exposure requires fabric reachability rather than ordinary IP routing. Leadership should prioritize verifying affected systems and applying the vendor patch because the vulnerability is remotely reachable without credentials on exposed fabrics.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.5%
Top 63% exploitable
Prevalence
Low
Linux kernel ubiquitous, but rtrs-srv/RNBD RDMA module niche, data-center only
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97413 ADVISORY https://vuldb.com/vuln/409546 REF https://git.kernel.org/stable/c/24ad03bfeda05fca04c56677e57fd3d6bc3e9978 REF https://git.kernel.org/stable/c/2c52b2afded988233cd4ccc185cf5147bbc77a76 REF https://git.kernel.org/stable/c/54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5 REF https://git.kernel.org/stable/c/6b1e26e70d7ca9f0906af2283558a530eeb1f066 REF https://git.kernel.org/stable/c/b042b4947752df0b3d16e683ac09fb4f7f0e33e0 REF https://git.kernel.org/stable/c/c76e9123ab91a903396d26e6ab1b5caae5c6b149

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy