CVE-2026-97413

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs-srv: Fix integer underflow in process_read and process_write

usr_len is read from a network-supplied message field (le16_to_cpu)

and used to compute data_len = off - usr_len without validating that

usr_len <= off. A malicious RDMA client can send usr_len > off causing

an integer underflow, resulting in data_len wrapping to a huge size_t

value which is then passed to the rdma_ev callback as a memory length,

leading to out-of-bounds memory access.

Fix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids()

in both process_read() and process_write(), ensuring the early return

path acquires no reference and has no resource leak.