A critical out-of-bounds memory access vulnerability in the Linux kernel RDMA subsystem enables unauthenticated remote attackers to potentially read sensitive memory or cause system instability.

The vulnerability exists in the rdma_write_sg function within the RTRS (RDMA Transport Server) component. Due to a failure to validate the length of RDMA-Write operations against the maximum chunk size, an unauthenticated remote peer can provide a malformed descriptor that forces the server to read beyond allocated memory buffers.

Successful exploitation allows an attacker to access unauthorized data stored in kernel memory or crash the system, leading to a denial-of-service condition. Given the CVSS score of 9.1, this flaw presents a critical risk to data confidentiality and service availability, particularly for high-performance computing or storage environments utilizing RDMA.

Immediate Action: Apply the latest security patches provided by your Linux distribution maintainer, ensuring the kernel is updated to at least version 5.10.266, 5.15.212, 6.1.178, or 6.6.145.

Proactive Monitoring: Monitor system logs for kernel panics or unusual RDMA connection behaviors that may indicate attempted exploitation of the RTRS subsystem.

Compensating Controls: Restrict network access to RDMA-enabled interfaces to trusted peers only, effectively limiting the attack surface for unauthenticated remote actors.

Public Exploit Available: Unknown

This vulnerability represents a significant threat to kernel integrity and should be addressed with high priority. Organizations utilizing RTRS should verify their kernel version and apply the recommended patches immediately to prevent potential remote memory disclosure or system compromise.