CVE-2025-68811

In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_range added rc_curpage (page index) to the page base instead of the byte offset rc_pageoff. Use rc_pageoff so copies land within the current page. Found by ZeroPath (https://zeropath.com)

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/2a77c8dd49bccf0ca232be7c836cec1209abb8da
https://git.kernel.org/stable/c/a8ee9099f30654917aa68f55d707b5627e1dbf77
https://git.kernel.org/stable/c/e8623e9c451e23d84b870811f42fd872b4089ef6

Configurations

No configuration.

History

19 Oct 2026, 19:17

Type	Values Removed	Values Added
CWE		CWE-787

Information

Published : 2026-01-13 16:16

Updated : 2026-10-19 19:17

NVD link : CVE-2025-68811

Mitre link : CVE-2025-68811

CVE.ORG link : CVE-2025-68811

JSON object : View

Products Affected

No product.

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2025-68811", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68811", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-16T16:28:47.245013Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8e122582680c6f8acd686a5a2af9c0e46fe90f2d", "lessThan": "e8623e9c451e23d84b870811f42fd872b4089ef6", "versionType": "git"}, {"status": "affected", "version": "8e122582680c6f8acd686a5a2af9c0e46fe90f2d", "lessThan": "2a77c8dd49bccf0ca232be7c836cec1209abb8da", "versionType": "git"}, {"status": "affected", "version": "8e122582680c6f8acd686a5a2af9c0e46fe90f2d", "lessThan": "a8ee9099f30654917aa68f55d707b5627e1dbf77", "versionType": "git"}], "programFiles": ["net/sunrpc/xprtrdma/svc_rdma_rw.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.64", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.3", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sunrpc/xprtrdma/svc_rdma_rw.c"], "defaultStatus": "affected"}]}], "published": "2026-01-13T16:16:03.300", "references": [{"url": "https://git.kernel.org/stable/c/2a77c8dd49bccf0ca232be7c836cec1209abb8da", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a8ee9099f30654917aa68f55d707b5627e1dbf77", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e8623e9c451e23d84b870811f42fd872b4089ef6", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: use rc_pageoff for memcpy byte offset\n\nsvc_rdma_copy_inline_range added rc_curpage (page index) to the page\nbase instead of the byte offset rc_pageoff. Use rc_pageoff so copies\nland within the current page.\n\nFound by ZeroPath (https://zeropath.com)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsvcrdma: usar rc_pageoff para el desplazamiento de bytes de memcpy\n\nsvc_rdma_copy_inline_range a\u00f1ad\u00eda rc_curpage (\u00edndice de p\u00e1gina) a la base de la p\u00e1gina en lugar del desplazamiento de bytes rc_pageoff. Usar rc_pageoff para que las copias caigan dentro de la p\u00e1gina actual.\n\nEncontrado por ZeroPath (https://zeropath.com)"}], "lastModified": "2026-10-19T19:17:06.337", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}