CVE-2026-97954: net/rds: fix tcp stream corruption with large pages

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

net/rds: fix tcp stream corruption with large pages

rdsmessagemappages() assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems with PAGESIZE greater than 8192 the scatterlist maps bytes beyond the end of the congestion map. RDS-TCP transmits the SG contents according to those lengths, so the extra bytes become part of the TCP RDS stream and are interpreted as subsequent RDS message headers, corrupting the stream.

Limit the final scatterlist mapping to the number of bytes remaining. This has no effect on systems with a 4K page size and allows RDS-TCP to be used on systems with 16K and larger page sizes.

The RDS selftest, which previously hung on 16K pages, now passes.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:23 AM
Data Sourced
via MITRE·10:23 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

Which systems are affected by this issue?

The issue affects RDS over TCP on systems using page sizes greater than 8192 bytes, including 16K and larger pages. Systems with a 4K page size are not affected.

2

What conditions are required for the corruption to occur?

RDS-TCP must be in use, and the system must have a page size larger than the 8192-byte RDS congestion map. Under those conditions, the final scatterlist entry can include bytes beyond the congestion map and transmit them as part of the RDS TCP stream.

3

How can administrators identify a likely affected deployment?

Check whether RDS-TCP is enabled or used and whether the system page size is 16K or larger. The RDS selftest previously hung on 16K-page systems, which is an additional indication of the affected behavior.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203