CVE-2026-97954: net/rds: fix tcp stream corruption with large pages
In the Linux kernel, the following vulnerability has been resolved:
net/rds: fix tcp stream corruption with large pages
rdsmessagemappages() assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems with PAGESIZE greater than 8192 the scatterlist maps bytes beyond the end of the congestion map. RDS-TCP transmits the SG contents according to those lengths, so the extra bytes become part of the TCP RDS stream and are interpreted as subsequent RDS message headers, corrupting the stream.
Limit the final scatterlist mapping to the number of bytes remaining. This has no effect on systems with a 4K page size and allows RDS-TCP to be used on systems with 16K and larger page sizes.
The RDS selftest, which previously hung on 16K pages, now passes.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue affects RDS over TCP on systems using page sizes greater than 8192 bytes, including 16K and larger pages. Systems with a 4K page size are not affected.
What conditions are required for the corruption to occur?
RDS-TCP must be in use, and the system must have a page size larger than the 8192-byte RDS congestion map. Under those conditions, the final scatterlist entry can include bytes beyond the congestion map and transmit them as part of the RDS TCP stream.
How can administrators identify a likely affected deployment?
Check whether RDS-TCP is enabled or used and whether the system page size is 16K or larger. The RDS selftest previously hung on 16K-page systems, which is an additional indication of the affected behavior.