CVE-2026-98366 (GCVE-0-2026-98366)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
Title
RDMA/rxe: validate access flags before swapping the MR's PD
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxe_rereg_user_mr() reassigns mr->ibmr.pd first and only then validates the IB_MR_REREG_ACCESS argument: if (flags & IB_MR_REREG_PD) { rxe_put(old_pd); rxe_get(pd); mr->ibmr.pd = ibpd; } if (flags & IB_MR_REREG_ACCESS) { if (access & ~RXE_ACCESS_SUPPORTED_MR) return ERR_PTR(-EOPNOTSUPP); mr->access = access; } Both flags pass the entry check because RXE_MR_REREG_SUPPORTED is IB_MR_REREG_PD | IB_MR_REREG_ACCESS, so a caller can reach the access check with mr->ibmr.pd already reassigned. mr->ibmr.pd is owned by the core, which adjusts pd->usecnt only on the success path: ib_uverbs_rereg_mr() jumps to put_new_uobj on a driver error without undoing the reassignment, so mr->pd == new_pd while the usecnts still charge the MR to orig_pd. ib_dereg_mr_user() then decrements new_pd, whose count can reach zero while a memory window still references it; uverbs_free_pd() frees the PD on that count alone and rxe_mw_cleanup() writes to freed memory: BUG: KASAN: slab-use-after-free in __rxe_put+0x31/0xa0 Write of size 4 at addr ffff8881301dd690 by task rxe_poc/591 __rxe_put+0x31/0xa0 rxe_mw_cleanup+0x42/0x200 __rxe_cleanup+0x115/0x370 rxe_dealloc_mw+0x4c/0x80 Allocated by task 591: ib_uverbs_alloc_pd+0x258/0x540 Freed by task 591: ib_dealloc_pd_user+0x174/0x210 uverbs_free_pd+0x8d/0xc0 ib_uverbs_dealloc_pd+0x18e/0x1d0 Validate the access flags before mutating any state so the callback either applies every requested change or none.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c , < 08f12745cb72981aa2cabe214af0c7a42a856f0a (git)
Affected: 544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c , < 7230cc456d4bb2221c20c5f1d22b38b8576aa16f (git)
Affected: 544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c , < fe602c91a52e161ace4afd5bdb8f33270c554c6f (git)
Affected: 544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c , < 4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8 (git)
Affected: 544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c , < ae36a5b609ae79f4de966328b78d2584be9719a4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.158 , ≤ 6.6.* (semver)
Unaffected: 6.12.112 , ≤ 6.12.* (semver)
Unaffected: 6.18.54 , ≤ 6.18.* (semver)
Unaffected: 7.2.8 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "08f12745cb72981aa2cabe214af0c7a42a856f0a",
              "status": "affected",
              "version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
              "versionType": "git"
            },
            {
              "lessThan": "7230cc456d4bb2221c20c5f1d22b38b8576aa16f",
              "status": "affected",
              "version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
              "versionType": "git"
            },
            {
              "lessThan": "fe602c91a52e161ace4afd5bdb8f33270c554c6f",
              "status": "affected",
              "version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
              "versionType": "git"
            },
            {
              "lessThan": "4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8",
              "status": "affected",
              "version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
              "versionType": "git"
            },
            {
              "lessThan": "ae36a5b609ae79f4de966328b78d2584be9719a4",
              "status": "affected",
              "version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: validate access flags before swapping the MR\u0027s PD\n\nrxe_rereg_user_mr() reassigns mr-\u003eibmr.pd first and only then\nvalidates the IB_MR_REREG_ACCESS argument:\n\n\tif (flags \u0026 IB_MR_REREG_PD) {\n\t\trxe_put(old_pd);\n\t\trxe_get(pd);\n\t\tmr-\u003eibmr.pd = ibpd;\n\t}\n\n\tif (flags \u0026 IB_MR_REREG_ACCESS) {\n\t\tif (access \u0026 ~RXE_ACCESS_SUPPORTED_MR)\n\t\t\treturn ERR_PTR(-EOPNOTSUPP);\n\t\tmr-\u003eaccess = access;\n\t}\n\nBoth flags pass the entry check because RXE_MR_REREG_SUPPORTED is\nIB_MR_REREG_PD | IB_MR_REREG_ACCESS, so a caller can reach the access\ncheck with mr-\u003eibmr.pd already reassigned.\n\nmr-\u003eibmr.pd is owned by the core, which adjusts pd-\u003eusecnt only on the\nsuccess path: ib_uverbs_rereg_mr() jumps to put_new_uobj on a driver error\nwithout undoing the reassignment, so mr-\u003epd == new_pd while the usecnts\nstill charge the MR to orig_pd. ib_dereg_mr_user() then decrements\nnew_pd, whose count can reach zero while a memory window still references\nit; uverbs_free_pd() frees the PD on that count alone and rxe_mw_cleanup()\nwrites to freed memory:\n\n  BUG: KASAN: slab-use-after-free in __rxe_put+0x31/0xa0\n  Write of size 4 at addr ffff8881301dd690 by task rxe_poc/591\n   __rxe_put+0x31/0xa0\n   rxe_mw_cleanup+0x42/0x200\n   __rxe_cleanup+0x115/0x370\n   rxe_dealloc_mw+0x4c/0x80\n  Allocated by task 591:\n   ib_uverbs_alloc_pd+0x258/0x540\n  Freed by task 591:\n   ib_dealloc_pd_user+0x174/0x210\n   uverbs_free_pd+0x8d/0xc0\n   ib_uverbs_dealloc_pd+0x18e/0x1d0\n\nValidate the access flags before mutating any state so the callback either\napplies every requested change or none."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bad access_flags/pd_handle reach rxe_rereg_user_mr() only through a local IB_USER_VERBS_CMD_REREG_MR on /dev/infiniband/uverbsN via ib_uverbs_rereg_mr(); no RoCE packet carries rereg arguments, so a remote peer cannot drive it.\nAC:L - Deterministic: flags IB_MR_REREG_PD|IB_MR_REREG_ACCESS with access=IB_ACCESS_RELAXED_ORDERING passes core ib_check_mr_access() but fails RXE_ACCESS_SUPPORTED_MR after mr-\u003eibmr.pd was swapped; the attacker then deregs the MR and deallocs the PD its own MW still uses. No race.\nPR:L - uverbs_devnode() creates /dev/infiniband/uverbsN mode 0666 and there is no capability check from ib_uverbs_rereg_mr() to rxe_rereg_user_mr(); any unprivileged local user owning a PD/MR/MW triggers it. Only the one-time admin rxe link creation (RDMA_NL_ADMIN_PERM) is needed.\nUI:N - The attacker\u0027s own process issues alloc_pd, reg_mr, alloc_mw, the failing rereg_mr, dereg_mr and dealloc_pd; no other user or administrator action is involved.\nS:U - The freed rxe PD and the corrupted refcounts are kernel heap objects within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After uverbs_free_pd() frees the PD on usecnt alone, the surviving MW still holds a dangling pointer to it; reclaiming that slab object with sprayed data turns later accesses through the MW into a use-after-free read of attacker-shaped memory.\nI:H - rxe_mw_cleanup() -\u003e __rxe_put() writes (refcount decrement, KASAN write of size 4) into the freed PD, and the inconsistent mr-\u003epd vs usecnt state can be repeated; a decrement into reallocated slab memory is a usable corruption primitive toward privilege escalation.\nA:H - The use-after-free write in __rxe_put() during rxe_dealloc_mw() corrupts freed slab memory and can oops or panic the kernel, and an unprivileged user can repeat it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T06:50:19.619Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/08f12745cb72981aa2cabe214af0c7a42a856f0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7230cc456d4bb2221c20c5f1d22b38b8576aa16f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe602c91a52e161ace4afd5bdb8f33270c554c6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae36a5b609ae79f4de966328b78d2584be9719a4"
        }
      ],
      "title": "RDMA/rxe: validate access flags before swapping the MR\u0027s PD",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98366",
    "datePublished": "2026-10-06T08:46:51.638Z",
    "dateReserved": "2026-09-25T10:25:14.344Z",
    "dateUpdated": "2026-10-07T06:50:19.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98366",
      "date": "2026-10-07",
      "epss": "0.00116",
      "percentile": "0.0149"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/sw/rxe/rxe_verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "08f12745cb72981aa2cabe214af0c7a42a856f0a",
                    "status": "affected",
                    "version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7230cc456d4bb2221c20c5f1d22b38b8576aa16f",
                    "status": "affected",
                    "version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fe602c91a52e161ace4afd5bdb8f33270c554c6f",
                    "status": "affected",
                    "version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8",
                    "status": "affected",
                    "version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ae36a5b609ae79f4de966328b78d2584be9719a4",
                    "status": "affected",
                    "version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/sw/rxe/rxe_verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.5"
                  },
                  {
                    "lessThan": "6.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: validate access flags before swapping the MR\u0027s PD\n\nrxe_rereg_user_mr() reassigns mr-\u003eibmr.pd first and only then\nvalidates the IB_MR_REREG_ACCESS argument:\n\n\tif (flags \u0026 IB_MR_REREG_PD) {\n\t\trxe_put(old_pd);\n\t\trxe_get(pd);\n\t\tmr-\u003eibmr.pd = ibpd;\n\t}\n\n\tif (flags \u0026 IB_MR_REREG_ACCESS) {\n\t\tif (access \u0026 ~RXE_ACCESS_SUPPORTED_MR)\n\t\t\treturn ERR_PTR(-EOPNOTSUPP);\n\t\tmr-\u003eaccess = access;\n\t}\n\nBoth flags pass the entry check because RXE_MR_REREG_SUPPORTED is\nIB_MR_REREG_PD | IB_MR_REREG_ACCESS, so a caller can reach the access\ncheck with mr-\u003eibmr.pd already reassigned.\n\nmr-\u003eibmr.pd is owned by the core, which adjusts pd-\u003eusecnt only on the\nsuccess path: ib_uverbs_rereg_mr() jumps to put_new_uobj on a driver error\nwithout undoing the reassignment, so mr-\u003epd == new_pd while the usecnts\nstill charge the MR to orig_pd. ib_dereg_mr_user() then decrements\nnew_pd, whose count can reach zero while a memory window still references\nit; uverbs_free_pd() frees the PD on that count alone and rxe_mw_cleanup()\nwrites to freed memory:\n\n  BUG: KASAN: slab-use-after-free in __rxe_put+0x31/0xa0\n  Write of size 4 at addr ffff8881301dd690 by task rxe_poc/591\n   __rxe_put+0x31/0xa0\n   rxe_mw_cleanup+0x42/0x200\n   __rxe_cleanup+0x115/0x370\n   rxe_dealloc_mw+0x4c/0x80\n  Allocated by task 591:\n   ib_uverbs_alloc_pd+0x258/0x540\n  Freed by task 591:\n   ib_dealloc_pd_user+0x174/0x210\n   uverbs_free_pd+0x8d/0xc0\n   ib_uverbs_dealloc_pd+0x18e/0x1d0\n\nValidate the access flags before mutating any state so the callback either\napplies every requested change or none."
          }
        ],
        "id": "CVE-2026-98366",
        "lastModified": "2026-10-07T07:17:10.960",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-06T09:18:30.823",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/08f12745cb72981aa2cabe214af0c7a42a856f0a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7230cc456d4bb2221c20c5f1d22b38b8576aa16f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ae36a5b609ae79f4de966328b78d2584be9719a4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fe602c91a52e161ace4afd5bdb8f33270c554c6f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.