Linux kernel RPC-over-RDMA server reply path overflows a 4096-byte heap buffer in net/sunrpc/xprtrdma/svc_rdma_sendto.c when a crafted client sends a large NFS READ with empty Write list and no Reply chunk, causing heap OOB write. Network attack requires CONFIG_SUNRPC_XPRT_RDMA/svcrdma and RDMA ( nfiniBand / RoCE). Impact: kernel crash/possible code exec. Disable/unload svcrdma, patch via vendor kernel updates (RHEL 6-10, kernel-rt 7-9) to mitigate.