CVE-2025-71068

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: bound check rq_pages index in inline path

svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array. Add guards before the first use and after advancing to a new page.

This vulnerability is rated as Moderate severity because exploitation requires an active SunRPC service explicitly configured to utilize RDMA transports, which is not enabled by default in Red Hat Enterprise Linux. An attacker must have network reachability or local access to interact with the RDMA RPC endpoint to trigger the out-of-bounds page array index, primarily leading to a denial of service via kernel crash. Standard environments that do not configure NFS over RDMA or load the RDMA transport module are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.