CVE-2026-64269 (GCVE-0-2026-64269)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-23 12:45
VLAI
Title
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg When the server answers an RTRS READ, rdma_write_sg() builds the source scatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the peer. Its length is taken directly from the wire descriptor: plist->length = le32_to_cpu(id->rd_msg->desc[0].len); rd_msg points into the chunk buffer that the remote peer filled via RDMA-WRITE-WITH-IMM (rtrs_srv_rdma_done() -> process_io_req() -> process_read()), so desc[0].len is attacker-controlled and, before this change, was only rejected when zero. The source address is the fixed chunk start (dma_addr[msg_id]) and the source lkey is the PD-wide local_dma_lkey, which is not tied to the chunk's MR mapping, so the verbs layer does not constrain the transfer length to max_chunk_size. msg_id and off are bounded against queue_depth and max_chunk_size in rtrs_srv_rdma_done(), but desc[0].len is a separate field that was not checked against the chunk size. A peer that advertises desc[0].len larger than max_chunk_size can make the posted RDMA write read past the chunk's mapped region. The resulting behaviour depends on the IOMMU configuration: with no IOMMU or in passthrough mode the read may extend into memory adjacent to the chunk and be returned to the peer, which can disclose host memory; with a translating IOMMU the out-of-range access is expected to fault and abort the connection. In either case the transfer exceeds what the protocol permits and is driven by a remote peer. Reject a descriptor length above max_chunk_size, mirroring the existing off >= max_chunk_size bound in rtrs_srv_rdma_done(). Legitimate clients do not exceed it: the client sets desc[0].len to its MR length, which is capped at the negotiated max_io_size (max_chunk_size - MAX_HDR_SIZE).
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9cb837480424e78ed585376f944088246685aec3 , < a35b7a8728a53ddc80b323970689fa5985816836 (git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < 68c09762172f6224e9ddf9b0a60bacbb36e443eb (git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < 6cada540150894e81042a0ae0c796a21a9a877da (git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < 2912f3d40355dabc08fdbaaf2764d02445fe88dc (git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < 6f40246f4312fdbab5a13cc440adebf95eb2aa66 (git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < 5a45d0aa1fa50a333ce5763ade744e2d89838667 (git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < da3e44add94b05dfde56f898421922f5cf35705f (git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < 963af8d97a8c6a117134a8d0db1415e0489200b1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/rtrs/rtrs-srv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a35b7a8728a53ddc80b323970689fa5985816836",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "68c09762172f6224e9ddf9b0a60bacbb36e443eb",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "6cada540150894e81042a0ae0c796a21a9a877da",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "2912f3d40355dabc08fdbaaf2764d02445fe88dc",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "6f40246f4312fdbab5a13cc440adebf95eb2aa66",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "5a45d0aa1fa50a333ce5763ade744e2d89838667",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "da3e44add94b05dfde56f898421922f5cf35705f",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "963af8d97a8c6a117134a8d0db1415e0489200b1",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/rtrs/rtrs-srv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg\n\nWhen the server answers an RTRS READ, rdma_write_sg() builds the source\nscatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the\npeer. Its length is taken directly from the wire descriptor:\n\n  plist-\u003elength = le32_to_cpu(id-\u003erd_msg-\u003edesc[0].len);\n\nrd_msg points into the chunk buffer that the remote peer filled via\nRDMA-WRITE-WITH-IMM (rtrs_srv_rdma_done() -\u003e process_io_req() -\u003e\nprocess_read()), so desc[0].len is attacker-controlled and, before this\nchange, was only rejected when zero. The source address is the fixed\nchunk start (dma_addr[msg_id]) and the source lkey is the PD-wide\nlocal_dma_lkey, which is not tied to the chunk\u0027s MR mapping, so the verbs\nlayer does not constrain the transfer length to max_chunk_size. msg_id\nand off are bounded against queue_depth and max_chunk_size in\nrtrs_srv_rdma_done(), but desc[0].len is a separate field that was not\nchecked against the chunk size.\n\nA peer that advertises desc[0].len larger than max_chunk_size can make\nthe posted RDMA write read past the chunk\u0027s mapped region. The resulting\nbehaviour depends on the IOMMU configuration: with no IOMMU or in\npassthrough mode the read may extend into memory adjacent to the chunk\nand be returned to the peer, which can disclose host memory; with a\ntranslating IOMMU the out-of-range access is expected to fault and abort\nthe connection. In either case the transfer exceeds what the protocol\npermits and is driven by a remote peer.\n\nReject a descriptor length above max_chunk_size, mirroring the existing\noff \u003e= max_chunk_size bound in rtrs_srv_rdma_done(). Legitimate clients\ndo not exceed it: the client sets desc[0].len to its MR length, which is\ncapped at the negotiated max_io_size (max_chunk_size - MAX_HDR_SIZE)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - RTRS accepts network connections over routable RDMA transports including RoCE and iWARP, and the malicious descriptor is supplied by a remote peer.\nAC:L - The peer directly controls the descriptor length and destination buffer; no race, timing, or victim-controlled state is required in no-IOMMU, passthrough, or software-RDMA deployments.\nPR:N - The handshake validates protocol fields but performs no credential, capability, or authentication check before publishing chunk rkeys and accepting I/O requests.\nUI:N - After connecting, the attacker can submit the crafted RDMA READ request without any victim action.\nS:U - The vulnerable RTRS module and affected host memory remain within the kernel\u0027s security authority; a translating IOMMU prevents rather than permits crossing its isolation boundary.\nC:H - The PD-wide local DMA key does not constrain the attacker-supplied transfer length, permitting a broad out-of-bounds read of adjacent host memory that is returned to the peer.\nI:N - The malformed operation reads server memory and writes it only to the peer\u0027s registered destination; it provides no server-side memory-write primitive.\nA:H - Software-RDMA can CPU-copy through invalid pages and oops or crash, while hardware or IOMMU faults can abort paths. An unauthenticated peer can trigger the condition repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:35.835Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a35b7a8728a53ddc80b323970689fa5985816836"
        },
        {
          "url": "https://git.kernel.org/stable/c/68c09762172f6224e9ddf9b0a60bacbb36e443eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cada540150894e81042a0ae0c796a21a9a877da"
        },
        {
          "url": "https://git.kernel.org/stable/c/2912f3d40355dabc08fdbaaf2764d02445fe88dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f40246f4312fdbab5a13cc440adebf95eb2aa66"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a45d0aa1fa50a333ce5763ade744e2d89838667"
        },
        {
          "url": "https://git.kernel.org/stable/c/da3e44add94b05dfde56f898421922f5cf35705f"
        },
        {
          "url": "https://git.kernel.org/stable/c/963af8d97a8c6a117134a8d0db1415e0489200b1"
        }
      ],
      "title": "RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64269",
    "datePublished": "2026-07-25T08:49:16.946Z",
    "dateReserved": "2026-07-19T15:36:31.775Z",
    "dateUpdated": "2026-08-23T12:45:35.835Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64269",
      "date": "2026-09-21",
      "epss": "0.00714",
      "percentile": "0.51807"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:51:23.000Z",
      "cve": "CVE-2026-64269",
      "id": "msrc_CVE-2026-64269",
      "initial_release_date": "2026-07-26T01:09:18.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64269.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/ulp/rtrs/rtrs-srv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a35b7a8728a53ddc80b323970689fa5985816836",
                    "status": "affected",
                    "version": "9cb837480424e78ed585376f944088246685aec3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "68c09762172f6224e9ddf9b0a60bacbb36e443eb",
                    "status": "affected",
                    "version": "9cb837480424e78ed585376f944088246685aec3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6cada540150894e81042a0ae0c796a21a9a877da",
                    "status": "affected",
                    "version": "9cb837480424e78ed585376f944088246685aec3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2912f3d40355dabc08fdbaaf2764d02445fe88dc",
                    "status": "affected",
                    "version": "9cb837480424e78ed585376f944088246685aec3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6f40246f4312fdbab5a13cc440adebf95eb2aa66",
                    "status": "affected",
                    "version": "9cb837480424e78ed585376f944088246685aec3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5a45d0aa1fa50a333ce5763ade744e2d89838667",
                    "status": "affected",
                    "version": "9cb837480424e78ed585376f944088246685aec3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "da3e44add94b05dfde56f898421922f5cf35705f",
                    "status": "affected",
                    "version": "9cb837480424e78ed585376f944088246685aec3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "963af8d97a8c6a117134a8d0db1415e0489200b1",
                    "status": "affected",
                    "version": "9cb837480424e78ed585376f944088246685aec3",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/ulp/rtrs/rtrs-srv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.8"
                  },
                  {
                    "lessThan": "5.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.266",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D05132FF-BB27-4358-B792-1FE8F15DB4EA",
                    "versionEndExcluding": "5.15.212",
                    "versionStartIncluding": "5.8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
                    "versionEndExcluding": "6.1.178",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
                    "versionEndExcluding": "6.6.145",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
                    "versionEndExcluding": "6.12.96",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
                    "versionEndExcluding": "6.18.39",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg\n\nWhen the server answers an RTRS READ, rdma_write_sg() builds the source\nscatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the\npeer. Its length is taken directly from the wire descriptor:\n\n  plist-\u003elength = le32_to_cpu(id-\u003erd_msg-\u003edesc[0].len);\n\nrd_msg points into the chunk buffer that the remote peer filled via\nRDMA-WRITE-WITH-IMM (rtrs_srv_rdma_done() -\u003e process_io_req() -\u003e\nprocess_read()), so desc[0].len is attacker-controlled and, before this\nchange, was only rejected when zero. The source address is the fixed\nchunk start (dma_addr[msg_id]) and the source lkey is the PD-wide\nlocal_dma_lkey, which is not tied to the chunk\u0027s MR mapping, so the verbs\nlayer does not constrain the transfer length to max_chunk_size. msg_id\nand off are bounded against queue_depth and max_chunk_size in\nrtrs_srv_rdma_done(), but desc[0].len is a separate field that was not\nchecked against the chunk size.\n\nA peer that advertises desc[0].len larger than max_chunk_size can make\nthe posted RDMA write read past the chunk\u0027s mapped region. The resulting\nbehaviour depends on the IOMMU configuration: with no IOMMU or in\npassthrough mode the read may extend into memory adjacent to the chunk\nand be returned to the peer, which can disclose host memory; with a\ntranslating IOMMU the out-of-range access is expected to fault and abort\nthe connection. In either case the transfer exceeds what the protocol\npermits and is driven by a remote peer.\n\nReject a descriptor length above max_chunk_size, mirroring the existing\noff \u003e= max_chunk_size bound in rtrs_srv_rdma_done(). Legitimate clients\ndo not exceed it: the client sets desc[0].len to its MR length, which is\ncapped at the negotiated max_io_size (max_chunk_size - MAX_HDR_SIZE)."
          }
        ],
        "id": "CVE-2026-64269",
        "lastModified": "2026-08-23T13:16:31.073",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:07.160",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2912f3d40355dabc08fdbaaf2764d02445fe88dc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5a45d0aa1fa50a333ce5763ade744e2d89838667"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/68c09762172f6224e9ddf9b0a60bacbb36e443eb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6cada540150894e81042a0ae0c796a21a9a877da"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6f40246f4312fdbab5a13cc440adebf95eb2aa66"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/963af8d97a8c6a117134a8d0db1415e0489200b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a35b7a8728a53ddc80b323970689fa5985816836"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/da3e44add94b05dfde56f898421922f5cf35705f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-27T09:34:44+00:00",
      "cve": "CVE-2026-64269",
      "id": "CVE-2026-64269",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64269.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:47:31Z",
      "cve": "CVE-2026-64269",
      "id": "CVE-2026-64269",
      "initial_release_date": "2026-07-25T16:46:56Z",
      "product_status:known_affected": "624",
      "product_status:known_not_affected": "126",
      "product_status:recommended": "87",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64269",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64269.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.