CVE-2025-71068

Root Cause The svcrdma module's svc_rdma_copy_inline_range function accesses rqstp->rq_pages using an index rc_curpage without verifying it stays within the allocated page array. This oversight allows an out-of-bounds read or write if rc_curpage exceeds the array size [1].

Exploitation An unauthenticated remote attacker with access to an NFS/RDMA service could potentially trigger this flaw by sending a specially crafted RDMA request that causes the inline copy path to increment rc_curpage beyond valid bounds. No special privileges beyond network access are required to reach the affected code [1].

Impact Successful exploitation could lead to memory corruption, resulting in a system crash (denial of service) or, under the right conditions, privilege escalation. The severity is assessed as High with a CVSS v3 score of 7.8 [1].

Mitigation The Linux kernel community has released patches that add bounds checking before the first use of rc_curpage and after advancing to a new page. These fixes are included in stable kernel updates [1]. Users should apply the latest updates from their distribution to remediate the vulnerability.