CVE-2026-74394

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) SCSI RDMA Protocol (SRP) Target (srpt) component. A remote attacker could exploit an integer overflow vulnerability in the immediate data length check. By sending a specially crafted network packet, a malicious initiator can cause the length calculation to wrap around, bypassing security checks and potentially leading to memory corruption or a denial of service.

This flaw is rated as having an Important impact because a network initiator can trigger kernel memory corruption or a system crash by exploiting integer overflow during immediate data transfer validation. Exploitation requires the host to actively operate as an SRP target over RDMA fabric, a specialized storage role that is neither loaded nor configured by default in Red Hat Enterprise Linux. Systems not configured with RDMA hardware and active SCSI target infrastructure are not exposed to this vulnerability over the network.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the ib_srpt kernel module from being loaded by blacklisting it in the modprobe configuration.

1. Add the module to a configuration file under /etc/modprobe.d/:

echo 'install ib_srpt /bin/true' > /etc/modprobe.d/disable-ib_srpt.conf

echo 'blacklist ib_srpt' >> /etc/modprobe.d/disable-ib_srpt.conf

2. If the module is currently loaded in memory, unload it:

modprobe -r ib_srpt

Caveats: This workaround disables all SCSI RDMA Protocol (SRP) target functionality on the host. Systems actively configured to provide storage targets over InfiniBand or RoCE cannot apply this mitigation without stopping SRP services.

Warning: Unloading the kernel module or rebooting the host will terminate active SRP sessions and can disrupt attached storage clients.