CVE-2026-90307

An out-of-bounds heap read in the RDMA/SRP initiator path can occur when srp_process_cred_req or srp_process_aer_req parses a truncated SRP_CRED_REQ or SRP_AER_REQ without verifying the received byte_len. A malicious or compromised SRP target can advertise a very small max_ti_iu_len and send an 8 byte SRP_CRED_REQ, causing the initiator to read req tag beyond the receive buffer and copy leaked heap bytes into the SRP_CRED_RSP sent back to the target. SRP_AER_REQ has a similar issue and can also read req lun from an insufficient buffer. For the CVSS the PR:N because the attacker only needs to control or compromise an SRP target reachable by the initiator and does not need local privileges on the initiator. The issue is adjacent network reachable in typical RDMA/SRP storage fabrics rather than broadly Internet reachable. Impact is information disclosure from kernel heap memory. No write primitive or direct privilege escalation path is shown by the code context.