In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg When the server answers an RTRS READ, rdma_write_sg() builds the source scatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the peer. Its length is taken directly from the wire descriptor: plist->length = le32_to_cpu(id->rd_msg->desc[0].len); rd_msg points into the chunk buffer that the remote peer filled via RDMA-WRITE-WITH-IMM (rtrs_srv_rdma_done() -> process_io_req() -> process_read()), so desc[0].len is attacker-controlled and, before this change, was only rejected when zero. The source address is the fixed chunk start (dma_addr[msg_id]) and the source lkey is the PD-wide local_dma_lkey, which is not tied to the chunk's MR mapping, so the verbs layer does not constrain the transfer length to max_chunk_size. msg_id and off are bounded against queue_depth and max_chunk_size in rtrs_srv_rdma_done(), but desc[0].len is a separate
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64269 is a critical vulnerability (CVSS 9.1) in the Linux kernel's RDMA/rtrs-srv component that fails to properly validate RDMA-Write operation lengths against chunk boundaries. When processing READ requests, the rdma_write_sg() function directly uses untrusted length values from wire descriptors without verifying they respect allocated chunk sizes, allowing remote attackers to write beyond buffer boundaries. This affects systems using RDMA (Remote Direct Memory Access) technology, particularly in high-performance computing, storage, and clustering environments where rtrs-srv handles remote peer communication.
While MITRE ATT&CK mappings are not yet assigned for this CVE, practitioners using Casky.ai would detect exploitation patterns consistent with memory corruption attacks—specifically reconnaissance of RDMA chunk allocations followed by crafted descriptor messages designed to trigger out-of-bounds writes. Casky's Claude AI-powered analysis, leveraging the 754 mapped security skills, would identify suspicious RDMA protocol anomalies such as descriptor length mismatches, unusual peer communication patterns, and kernel memory access violations. Security teams would observe findings related to improper input validation (CWE-20 class behaviors) and buffer overflow exploitation attempts, enabling detection of both active exploitation and post-compromise RDMA-based lateral movement within clustered infrastructure.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64269. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation