In the Linux kernel through 4.14.13, the rds_message_alloc_sgs() function
does not validate a value that is used during DMA page allocation, leading
to a heap-based out-of-bounds write (related to the rds_rdma_extra_size
function in net/rds/rdma.c).

It was discovered that the Reliable Datagram Socket (RDS) implementation in
the Linux kernel contained an out-of-bounds write during RDMA page
allocation. An attacker could use this to cause a denial of service (system
crash) or possibly execute arbitrary code.