CVE-2025-71068

svcrdma: bound check rq_pages index in inline path

State: Published
Severity: 9.8 Critical
Published: Jan 13, 2026
Updated: Oct 30, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: bound check rq_pages index in inline path

svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array. Add guards before the first use and after advancing to a new page.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	d7cc73972661be4a02a1b09f1d9b3283c6c05154 to before a22316f5e9a29e4b92030bd8fb9435fe0eb1d5c9Affected d7cc73972661be4a02a1b09f1d9b3283c6c05154 to before a1ed26debcc74050d3000dff7c4ea5e77f830695Affected d7cc73972661be4a02a1b09f1d9b3283c6c05154 to before 7ba826aae1d43212f3baa53a2175ad949e21926eAffected d7cc73972661be4a02a1b09f1d9b3283c6c05154 to before 5f140b525180c628db8fa6c897f138194a2de417Affected d7cc73972661be4a02a1b09f1d9b3283c6c05154 to before da1ccfc4c452541584a4eae89e337cfa21be6d5aAffected d7cc73972661be4a02a1b09f1d9b3283c6c05154 to before d1bea0ce35b6095544ee82bb54156fc62c067e58Affected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.198 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.64 through 6.12.Not affected 6.18.3 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

d7cc73972661be4a02a1b09f1d9b3283c6c05154 to before a22316f5e9a29e4b92030bd8fb9435fe0eb1d5c9Affected
d7cc73972661be4a02a1b09f1d9b3283c6c05154 to before a1ed26debcc74050d3000dff7c4ea5e77f830695Affected
d7cc73972661be4a02a1b09f1d9b3283c6c05154 to before 7ba826aae1d43212f3baa53a2175ad949e21926eAffected
d7cc73972661be4a02a1b09f1d9b3283c6c05154 to before 5f140b525180c628db8fa6c897f138194a2de417Affected
d7cc73972661be4a02a1b09f1d9b3283c6c05154 to before da1ccfc4c452541584a4eae89e337cfa21be6d5aAffected
d7cc73972661be4a02a1b09f1d9b3283c6c05154 to before d1bea0ce35b6095544ee82bb54156fc62c067e58Affected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.198 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.64 through 6.12.*Not affected
6.18.3 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.