CVE-2026-97413

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs-srv: Fix integer underflow in processread and processwrite

usrlen is read from a network-supplied message field (le16to_cpu)

and used to compute datalen = off - usrlen without validating that

usrlen <= off. A malicious RDMA client can send usrlen > off causing

an integer underflow, resulting in datalen wrapping to a huge sizet

value which is then passed to the rdma_ev callback as a memory length,

leading to out-of-bounds memory access.

Fix by reading and validating usrlen <= off before rtrssrvgetops_ids()

in both processread() and processwrite(), ensuring the early return

path acquires no reference and has no resource leak.