An unsigned integer underflow in the Linux kernel’s SVCRDMA implementation causes an out‑of‑bounds read when a parsed chunk list contains a chunk whose segment count is zero. The buggy macro calculates an inclusive upper bound that wraps to 0xFFFFFFFF, causing the loop body to walk memory beyond the intended flex array and trigger a general protection fault. This fault crashes the kernel, resulting in a denial‑of‑service condition. The weakness corresponds to CWE‑125, meaning it is an out‑of‑bounds read vulnerability.

Linux kernels that expose the SunRPC RDMA interface through the net/sunrpc/xprtrdma code path are affected. Any system running a kernel version prior to the fix and that accepts RDMA traffic will contain the vulnerable code. The fix was made in the svcrdma component, so all distributions that ship the affected kernel will be impacted unless the code path is disabled.

The CVSS base score is 5.9 and the EPSS score is less than 1 %, indicating a low probability of widespread exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is remote: an attacker can craft RDMA packets that advertise a zero‑segment chunk and send them to an exposed SunRPC RDMA service, causing the kernel to crash. Because the flaw does not provide code execution, the main risk is availability loss on a vulnerable host. Exposed RDMA interfaces increase risk; hosts without RDMA services or with the interface disabled are effectively immune.