CVE-2025-68811

What it actually does

Incorrect use of page index instead of byte offset in svc_rdma_copy_inline_range causes memcpy to write outside the target page boundary, resulting in memory corruption within the Linux kernel's RDMA server code.

Why it matters to the business

Linux servers using RDMA may experience crashes, data corruption, or potential privilege escalation, impacting service availability and security for systems relying on stable kernel networking.

How an attack unfolds

An attacker sends specially crafted RDMA inline requests to a vulnerable Linux kernel that trigger the faulty copy function, leading to out-of-bounds memory writes that can be leveraged for denial of service or code execution.

How to fix it

Upgrade the Linux kernel to the commit e8623e9c451e23d84b870811f42fd872b4089ef6 or later stable releases containing the svcrdma fix.

How to confirm the fix worked

Verify the presence of commit e8623e9c451e23d84b870811f42fd872b4089ef6 in the kernel source tree or confirm the corrected rc_pageoff usage in svc_rdma_copy_inline_range via code inspection or runtime testing.

Typical attack path

1. Locate Linux systems exposing RDMA services
2. Craft RDMA requests exercising svc_rdma_copy_inline_range with non-zero rc_pageoff
3. Trigger out-of-bounds memcpy write
4. Escalate via corrupted kernel memory structures

How to detect it

Review kernel logs for svcrdma oops or page fault messages around the time of suspected activity and inspect RDMA traffic patterns for anomalous inline data sizes.

• svc_rdma_copy_inline_range
• rc_pageoff
• rc_curpage

What your security team should do

• Apply the referenced kernel commit across all affected systems without delay
• Disable RDMA interfaces where not strictly required
• Monitor kernel logs for svcrdma-related faults during rollout