Linux Kernel EUVD-2026-59541

Exploitation requires the target host to have the RDMA SRP target driver (ib_srpt) loaded and an SRP target configured/exported, and the attacker must be able to act as an SRP initiator on the same InfiniBand/RoCE RDMA fabric to send a command with attacker-chosen immediate-data length (imm_buf->len = 0xFFFFFFFF). Limiting factors: ib_srpt is a non-default, specialized module used mainly in HPC/storage fabrics and is not present on typical servers; the RDMA fabric is normally a private, physically isolated storage network rather than the public internet; and while the CVSS vector states PR:N/UI:N (no authentication or user interaction on the SRP protocol level), reachability is gated by fabric access and any partitioning (pkey) controls in place.

The signals are sharply divergent and should be weighed together rather than trusting the headline number. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full H/H/H impact), which treats this as a trivially remote, unauthenticated, high-impact flaw; however, EPSS is only 0.19% (8th percentile), it is not on CISA KEV, and no POC is referenced - so there is no evidence of real-world exploitation. The critical missing nuance is that 'network vector' here means the RDMA fabric: exploitation requires the ib_srpt target module to be loaded and an SRP target configured, and the attacker must be a peer initiator able to speak SRP on that InfiniBand/RoCE fabric - a precondition the base CVSS score does not capture. That combination means the practical population of exposed systems is small (HPC, SAN/NVMe-oF-adjacent storage fabrics) and typically not internet-facing. Where ib_srpt IS in use, though, the impact is severe kernel memory corruption reachable pre-authentication over the fabric, so any operator running SRP targets should treat patching as urgent even though the raw internet-wide risk is modest. Net assessment: high-CVSS but low aggregate real-world risk today, gated hard by a non-default, specialized deployment requirement - prioritize it specifically on RDMA storage targets rather than as a fleet-wide emergency.

An attacker with the ability to act as an SRP initiator on a shared InfiniBand/RoCE fabric connects to a host running the ib_srpt target and issues an SRP command carrying immediate data with len set to 0xFFFFFFFF. The oversized length wraps the size check and is passed to sg_init_one(), corrupting kernel memory and at minimum crashing the target (denial of service), with potential for further exploitation. No public POC is referenced, and reliable code execution from the wrapped scatterlist would require additional heap/memory grooming.