In the Linux kernel, the RDMA/rtrs server component incorrectly trusts a client‑supplied length field when building an RDMA‑WRITE operation. The server uses the descriptor length from the wire message without checking it against the maximum chunk size that the server allocates. A malicious peer can therefore request an RDMA write that reads past the end of the pre‑allocated chunk memory. If the host lacks a translating IOMMU or is running in passthrough mode, that out‑of‑range read can pull data from kernel memory adjacent to the chunk, which the peer subsequently receives, resulting in remote disclosure of host memory. With a translating IOMMU the write fault will abort the connection, but the protocol violation would still be observable. No privilege escalation or code execution capability is provided by the flaw.

Any Linux kernel that includes the rtrs_srv RDMA server and has not applied the patch that bounds RDMA‑write lengths in rdma_write_sg is affected. This applies to all vendors that ship a kernel containing the rtrs_srv component, as the known CNA list confirms the vulnerability is present in the generic Linux kernel.

The flaw is a missing bounds check (CWE‑125). The CVSS score of 9.1 reflects high impact, while the EPSS score of < 1% indicates that exploitation is believed to be rare, especially given the need for RDMA connectivity and a specific kernel configuration. The vulnerability is not listed in the CISA KEV catalog. An attacker would need a remote RDMA session with the vulnerable host to send an engineered WR_RDMA_WRITE with an oversized descriptor length. Successful exploitation would result in memory disclosure but would not provide an avenue for privilege escalation.