Boundary Write Vulnerability in Linux Kernel RDMA Implementation

CVE-2026-98323

What is CVE-2026-98323?

A vulnerability exists in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem, specifically within the siw_get_hdr() function. This issue occurs when an extended DDP/RDMAP header is segmented across more than one TCP callback. As a result, the initial callback may receive a majority of the header, but the subsequent callback miscalculates the remaining bytes to be copied. This can lead to the destination buffer being accessed beyond its intended bounds, potentially overwriting critical state information, including the receive state value. This vulnerability necessitates careful handling of header length calculations to mitigate the risk of out-of-bounds writes.

References