The Linux kernel’s svcrdma module fails to validate the length of read segments in incoming RDMA RPC requests. An attacker can supply an oversized length, causing the internal bvec allocation to grow without bounds. When the allocation triggers the page‑overrun guard, the kernel leaks a read‑write context, resulting in a resource leak that can be repeatedly triggered to exhaust kernel memory. This weakness corresponds to CWE-772 and can lead to denial of service on hosts that host RDMA RPC services.

The flaw is present in all Linux kernel releases that contain the svcrdma implementation, up to the patched commit that rejects oversized read segments supplied, so all affected kernels should be treated as vulnerable until the patch is applied. Systems that provide RDMA-based Remote Procedure Call services are directly impacted.

The CVSS score of 5.9 indicates moderate severity; the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is remote via an attacker able to send crafted RDMA RPC packets to a host exposing the svcrdma service. Successful exploitation requires no privileged access to the kernel; a client that can manipulate RDMA traffic can trigger the allocation path repeatedly to deplete memory, potentially causing system instability or a restart.