In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer...

{
  "credits": [],
  "cve_id": "CVE-2026-97413",
  "cvss": {
    "score": 9.8,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.8,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [],
  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Fix integer underflow in process_read and process_write\n\nusr_len is read from a network-supplied message field (le16_to_cpu)\nand used to compute data_len = off - usr_len without validating that\nusr_len <= off. A malicious RDMA client can send usr_len > off causing\nan integer underflow, resulting in data_len wrapping to a huge size_t\nvalue which is then passed to the rdma_ev callback as a memory length,\nleading to out-of-bounds memory access.\n\nFix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids()\nin both process_read() and process_write(), ensuring the early return\npath acquires no reference and has no resource leak.",
  "epss": {
    "percentage": 0.00452,
    "percentile": 0.366
  },
  "ghsa_id": "GHSA-wv45-qhgq-9h5f",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-wv45-qhgq-9h5f",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-wv45-qhgq-9h5f"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-97413"
    }
  ],
  "nvd_published_at": "2026-09-24T17:17:18Z",
  "published_at": "2026-09-24T18:31:31Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-97413",
    "https://git.kernel.org/stable/c/24ad03bfeda05fca04c56677e57fd3d6bc3e9978",
    "https://git.kernel.org/stable/c/54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5",
    "https://git.kernel.org/stable/c/c76e9123ab91a903396d26e6ab1b5caae5c6b149",
    "https://github.com/advisories/GHSA-wv45-qhgq-9h5f"
  ],
  "repository_advisory_url": null,
  "severity": "critical",
  "source_code_location": "",
  "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Fix integer...",
  "type": "unreviewed",
  "updated_at": "2026-09-25T06:31:35Z",
  "url": "https://api.github.com/advisories/GHSA-wv45-qhgq-9h5f",
  "vulnerabilities": [],
  "withdrawn_at": null
}

{
  "credits": [],
  "cve_id": "CVE-2026-97413",
  "cvss": {
    "score": 9.8,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.8,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [],
  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Fix integer underflow in process_read and process_write\n\nusr_len is read from a network-supplied message field (le16_to_cpu)\nand used to compute data_len = off - usr_len without validating that\nusr_len <= off. A malicious RDMA client can send usr_len > off causing\nan integer underflow, resulting in data_len wrapping to a huge size_t\nvalue which is then passed to the rdma_ev callback as a memory length,\nleading to out-of-bounds memory access.\n\nFix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids()\nin both process_read() and process_write(), ensuring the early return\npath acquires no reference and has no resource leak.",
  "epss": {
    "percentage": 0.00452,
    "percentile": 0.366
  },
  "ghsa_id": "GHSA-wv45-qhgq-9h5f",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-wv45-qhgq-9h5f",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-wv45-qhgq-9h5f"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-97413"
    }
  ],
  "nvd_published_at": "2026-09-24T17:17:18Z",
  "published_at": "2026-09-24T18:31:31Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-97413",
    "https://git.kernel.org/stable/c/24ad03bfeda05fca04c56677e57fd3d6bc3e9978",
    "https://git.kernel.org/stable/c/54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5",
    "https://git.kernel.org/stable/c/c76e9123ab91a903396d26e6ab1b5caae5c6b149",
    "https://github.com/advisories/GHSA-wv45-qhgq-9h5f"
  ],
  "repository_advisory_url": null,
  "severity": "critical",
  "source_code_location": "",
  "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Fix integer...",
  "type": "unreviewed",
  "updated_at": "2026-09-25T06:31:35Z",
  "url": "https://api.github.com/advisories/GHSA-wv45-qhgq-9h5f",
  "vulnerabilities": [],
  "withdrawn_at": null
}