CVE-2025-68811

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: use rc_pageoff for memcpy byte offset

svc_rdma_copy_inline_range added rc_curpage (page index) to the page base instead of the byte offset rc_pageoff. Use rc_pageoff so copies land within the current page.

Found by ZeroPath (https://zeropath.com)

This is an out-of-bounds write caused by using a page index (rc_curpage) as a byte offset in memcpy(). A remote NFS/RDMA client can trigger memory corruption or kernel crashes by sending specially crafted inline data. In the worst case, this breaks the memory safety assumptions of the RDMA receive path and may allow cross-object memory corruption. Although the issue is remotely triggerable, the attack vector is Adjacent (AV:A), since it requires access to an authorized NFS over RDMA fabric and cannot be exploited from the general Internet. This makes it a storage-network-level vulnerability rather than a public network exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module rpcrdma from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.