https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 06:19:56 +0000 https://vulnerability.circl.lu/vuln/cve-2026-97413 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>RDMA/rtrs-srv: Fix integer underflow in process_read and process_write</p> <p>usr_len is read from a network-supplied message field (le16_to_cpu) and used to compute data_len = off - usr_len without validating that usr_len &lt;= off. A malicious RDMA client can send usr_len &gt; off causing an integer underflow, resulting in data_len wrapping to a huge size_t value which is then passed to the rdma_ev callback as a memory length, leading to out-of-bounds memory access.</p> <p>Fix by reading and validating usr_len &lt;= off before rtrs_srv_get_ops_ids() in both process_read() and process_write(), ensuring the early return path acquires no reference and has no resource leak.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>RDMA/rtrs-srv: Fix integer underflow in process_read and process_write</p> <p>usr_len is read from a network-supplied message field (le16_to_cpu) and used to compute data_len = off - usr_len without validating that usr_len &lt;= off. A malicious RDMA client can send usr_len &gt; off causing an integer underflow, resulting in data_len wrapping to a huge size_t value which is then passed to the rdma_ev callback as a memory length, leading to out-of-bounds memory access.</p> <p>Fix by reading and validating usr_len &lt;= off before rtrs_srv_get_ops_ids() in both process_read() and process_write(), ensuring the early return path acquires no reference and has no resource leak.</p> https://vulnerability.circl.lu/vuln/cve-2026-97413