CVE-2026-64269: Linux Kernel Info Disclosure Vulnerability

CVE-2026-64269 Overview

CVE-2026-64269 is an out-of-bounds read vulnerability in the Linux kernel's RDMA rtrs-srv (RDMA Transport Server) module. The flaw resides in rdma_write_sg(), which handles RTRS READ responses by posting an IB_WR_RDMA_WRITE back to the peer. The function accepts an attacker-controlled desc[0].len field from the wire descriptor without validating it against max_chunk_size. A remote peer that supplies an oversized length can trigger an RDMA write that reads past the mapped chunk region, potentially disclosing adjacent host memory or aborting the connection depending on IOMMU configuration.

Critical Impact
A remote unauthenticated peer can induce out-of-bounds reads from server memory, leading to host memory disclosure or connection abort over RDMA fabric.

Affected Products

Linux kernel versions containing the RDMA/rtrs-srv subsystem prior to the referenced stable patches
Systems using the RTRS (RDMA Transport) server component for block storage over RDMA
Environments running with no IOMMU or IOMMU in passthrough mode (higher disclosure risk)

Discovery Timeline

2026-07-25 - CVE-2026-64269 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64269

Vulnerability Analysis

The vulnerability exists in the RTRS server's read-response path. When the server responds to an RTRS READ request, rdma_write_sg() constructs the source scatter/gather entry for the outgoing IB_WR_RDMA_WRITE. The length assignment reads directly from the wire descriptor:

plist->length = le32_to_cpu(id->rd_msg->desc[0].len);

Because rd_msg points into the chunk buffer that the remote peer previously populated via RDMA-WRITE-WITH-IMM, the desc[0].len field is fully attacker-controlled. Prior to the patch, the code rejected only a zero-length value. The source address is the fixed chunk start dma_addr[msg_id], and the source lkey is the protection-domain-wide local_dma_lkey. This lkey is not bound to the chunk's memory region mapping, so the verbs layer imposes no length constraint tied to max_chunk_size.

Root Cause

The root cause is missing input validation [CWE-125] on a length field derived from an untrusted network peer. While msg_id and off are bounded against queue_depth and max_chunk_size in rtrs_srv_rdma_done(), the separate desc[0].len field bypassed those checks. Legitimate clients cap this value at the negotiated max_io_size (max_chunk_size - MAX_HDR_SIZE), but a malicious peer can advertise arbitrary values.

Attack Vector

A remote peer holding an RTRS connection can issue a crafted READ request whose descriptor advertises desc[0].len larger than max_chunk_size. The server then posts an RDMA write that reads past the chunk's mapped region. With no IOMMU or IOMMU passthrough, the read may return adjacent host memory to the peer, disclosing kernel data. With a translating IOMMU, the out-of-range access faults and aborts the connection, producing a denial-of-service condition. The transfer is initiated across the RDMA fabric without authentication beyond the existing session.

No verified proof-of-concept code is publicly available. See the upstream commits for the fix implementation details.

Detection Methods for CVE-2026-64269

Indicators of Compromise

Unexpected RDMA connection aborts or IOMMU fault events in kernel logs on RTRS server hosts
Anomalous rtrs-srv warning messages related to descriptor length rejections after patching
Elevated RDMA completion errors on InfiniBand or RoCE interfaces from specific peer GIDs

Detection Strategies

Audit kernel version and rtrs-srv module presence across storage servers to identify exposure
Monitor dmesg and syslog for IOMMU DMA faults correlated with RDMA traffic
Inspect RDMA connection logs for peers repeatedly triggering aborted transfers, which may indicate probing

Monitoring Recommendations

Collect and centralize kernel logs from RDMA-attached storage nodes for anomaly review
Alert on RDMA completion queue error rates exceeding baseline on rtrs-srv hosts
Track connection lifecycle events from RTRS clients to identify unusual peer behavior

How to Mitigate CVE-2026-64269

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the Kernel Security Fix and related stable branch commits
Inventory hosts loading the rtrs_server kernel module and prioritize patching for internet-adjacent or multi-tenant fabrics
Restrict RDMA fabric access to trusted peers using subnet manager policies and partition keys

Patch Information

The fix rejects any desc[0].len greater than max_chunk_size, mirroring the existing off >= max_chunk_size bound in rtrs_srv_rdma_done(). Patches are available across multiple stable branches: 2912f3d4, 5a45d0aa, 68c09762, 6cada540, 6f40246f, 963af8d9, and da3e44ad.

Workarounds

Unload the rtrs_server module on hosts that do not require RTRS block storage functionality
Enable a translating IOMMU in enforcing mode to convert out-of-bounds reads into faults rather than memory disclosure
Segment RDMA fabrics so that RTRS servers only accept connections from vetted client GIDs

bash

# Verify rtrs-srv module status and unload if unused
lsmod | grep rtrs_server
sudo modprobe -r rtrs_server

# Confirm IOMMU is enabled and enforcing (x86_64 example)
dmesg | grep -i -e DMAR -e IOMMU
cat /sys/class/iommu/*/intel-iommu/version 2>/dev/null