A critical buffer overflow vulnerability in the Linux kernel RPC-over-RDMA subsystem could allow an unauthenticated attacker to achieve remote code execution or system instability.

The flaw occurs in the svc_rdma_pull_up_needed function, where insufficient bounds checking on RPC-over-RDMA inline replies allows data to be copied beyond the allocated buffer (sc_xprt_buf). This memory corruption can be triggered by an unauthenticated attacker sending a specially crafted request that forces a reply requiring more scatter/gather entries than supported by the device.

The potential impact of this vulnerability is severe, as it allows for arbitrary memory corruption within the kernel. Successful exploitation could lead to a complete system compromise, including unauthorized access to sensitive data or a denial of service through kernel panic. Given the CVSS score of 9.8, this vulnerability represents a critical risk to infrastructure stability and data confidentiality.

Immediate Action: Update the Linux kernel to the corrected versions (6.12.109, 6.18.50, or 7.2.4) or apply the upstream patches provided in the reference links.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected service restarts related to the RDMA stack.

Compensating Controls: If patching is not immediately feasible, consider disabling the RPC-over-RDMA transport module if it is not required for production workflows to reduce the attack surface.

Public Exploit Available: Unknown

Due to the critical nature of this kernel-level memory corruption vulnerability, administrators should prioritize patching affected systems. Given the potential for remote exploitation, ensure that servers utilizing RDMA protocols are isolated or updated as soon as the vendor provides stable packages for your specific distribution.