CVE-2026-64268

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/siw: bound Read Response placement to the RREAD length<br /> <br /> In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each<br /> inbound Read Response DDP segment at sge-&gt;laddr + wqe-&gt;processed and then<br /> accumulates wqe-&gt;processed, but it never checks the running total against<br /> the sink buffer length on continuation segments. siw_check_sge() resolves<br /> and validates the sink memory only on the first fragment (the if (!*mem)<br /> branch), and siw_rresp_check_ntoh() compares the cumulative length against<br /> wqe-&gt;bytes only on the final segment (the !frx-&gt;more_ddp_segs guard).<br /> <br /> A connected siw peer that answers an outstanding RREAD with Read Response<br /> segments that keep the DDP Last flag clear, carrying more total payload<br /> than the RREAD requested, drives wqe-&gt;processed past the validated sink<br /> buffer; the next siw_rx_data() call writes out of bounds at<br /> sge-&gt;laddr + wqe-&gt;processed. siw runs iWARP over ordinary routable TCP,<br /> so the peer is the remote end of an established RDMA connection and needs<br /> no local privilege.<br /> <br /> Bound every segment before placement, exactly as siw_proc_send() and<br /> siw_proc_write() already do for their tagged and untagged paths, and<br /> terminate the connection with a base-or-bounds DDP error when the<br /> Read Response would overrun the sink buffer.<br /> <br /> This is the second receive-path length fix for this file. A separate<br /> change rejects an MPA FPDU length that underflows the per-fragment<br /> remainder in the header decode; that guard does not cover this case,<br /> because here each individual segment length is self-consistent and only<br /> the accumulated placement offset overruns the buffer.