CVE-2025-68811: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68811 is a memory corruption vulnerability in the Linux kernel's svcrdma (SVC RDMA) subsystem, caused by an incorrect offset calculation in the svc_rdma_copy_inline_range function. The bug results from using rc_curpage (a page index) instead of rc_pageoff (a byte offset) when computing the destination address for a memcpy operation, causing data to be written outside the intended page boundary. It was discovered by ZeroPath and disclosed on January 13, 2026. Affected versions include Linux kernel commits from 8e122582680c6f8acd686a5a2af9c0e46fe90f2d up to the fixes in stable branches; patched versions include 6.12.64, 6.18.3, and 6.19-rc3. No official CVSS score has been assigned by NVD at this time; Feedly estimates the severity as Medium with an EPSS score of 0.017% (Feedly, NVD).

The root cause is an incorrect variable used as a byte offset in the svc_rdma_copy_inline_range() function within the kernel's RDMA (Remote Direct Memory Access) server transport layer (net/sunrpc/xprtrdma/svc_rdma_recvfrom.c). Specifically, rc_curpage — which holds a page index (an integer counting pages) — was added to the page base address instead of rc_pageoff, which holds the actual byte offset within the current page. This off-by-one-page-sized error causes memcpy to write data to an incorrect memory location, potentially overwriting adjacent memory. The vulnerability is classified under memory safety issues (likely CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). Exploitation would require the ability to trigger RDMA inline data copy operations on an affected NFS-over-RDMA server (NVD, Feedly).

Successful exploitation of this vulnerability could result in kernel memory corruption, potentially leading to system crashes (denial of service), information disclosure from adjacent kernel memory pages, or — in a worst-case scenario — privilege escalation if the corrupted memory region contains security-sensitive data structures. The impact is limited to systems running Linux kernel NFS servers with RDMA transport (svcrdma) enabled, which is a specialized configuration not present in typical deployments. There is no evidence of lateral movement capability directly attributable to this bug, but kernel-level memory corruption can undermine the integrity of the entire system (NVD, Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in stable branches. Fixed versions include Linux kernel 6.12.64, 6.18.3, and 6.19-rc3. The fix changes svc_rdma_copy_inline_range to use rc_pageoff (byte offset) instead of rc_curpage (page index) for the memcpy destination calculation. Administrators running NFS-over-RDMA servers should update to a patched kernel version as soon as possible. As a workaround, disabling RDMA transport for NFS (svcrdma module) eliminates exposure if the feature is not required (NVD, Red Hat Advisory, Ubuntu Advisory).

The vulnerability was discovered and reported by ZeroPath, an automated security research firm, which is credited in the kernel commit message. Red Hat issued security advisories (RHSA-2026:2282, RHSA-2026:2722, RHSA-2026:4745, RHSA-2026:6692) addressing this CVE, and Ubuntu released multiple security notices (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1). Rocky Linux and AlmaLinux also issued corresponding advisories. No notable social media discussion or broader community controversy has been observed (Red Hat Advisory, Ubuntu Advisory).