7.5
/ 10
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c
unconditionally dereferences 8 bytes at payload_addr(pkt):
value = *(u64 *)payload_addr(pkt);
check_rkey() previously accepted an ATOMIC_WRITE request with pktlen ==
resid == 0 because the length validation only compared pktlen against
resid. A remote initiator that sets the RETH length to 0 therefore reaches
atomic_write_reply() with a zero-byte logical payload, and the responder
reads sizeof(u64) bytes from past the logical end of the packet into
skb->head tailroom, then writes those 8 bytes into the attacker's MR via
rxe_mr_do_atomic_write(). That is a remote disclosure of 4 bytes of kernel
tailroom per probe (the other 4 bytes are the packet's own trailing ICRC).
IBA oA19-28 defines ATOMIC_WRITE as exactly 8 bytes. Anything else is
protocol-invalid. Hoist a strict length check into check_rkey() so the
responder never reaches the unchecked dereference, and keep the existing
WRITE-family length logic for the normal RDMA WRITE path.
Reproduced on mainline with an unmodified rxe driver: a sustained
zero-length ATOMIC_WRITE probe repeatedly leaks adjacent skb head-buffer
bytes into the attacker's MR, including recognisable kernel strings and
partial kernel-direct-map pointer words. With this patch applied the
responder rejects the PDU and the MR stays all-zero.
RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c
unconditionally dereferences 8 bytes at payload_addr(pkt):
value = *(u64 *)payload_addr(pkt);
check_rkey() previously accepted an ATOMIC_WRITE request with pktlen ==
resid == 0 because the length validation only compared pktlen against
resid. A remote initiator that sets the RETH length to 0 therefore reaches
atomic_write_reply() with a zero-byte logical payload, and the responder
reads sizeof(u64) bytes from past the logical end of the packet into
skb->head tailroom, then writes those 8 bytes into the attacker's MR via
rxe_mr_do_atomic_write(). That is a remote disclosure of 4 bytes of kernel
tailroom per probe (the other 4 bytes are the packet's own trailing ICRC).
IBA oA19-28 defines ATOMIC_WRITE as exactly 8 bytes. Anything else is
protocol-invalid. Hoist a strict length check into check_rkey() so the
responder never reaches the unchecked dereference, and keep the existing
WRITE-family length logic for the normal RDMA WRITE path.
Reproduced on mainline with an unmodified rxe driver: a sustained
zero-length ATOMIC_WRITE probe repeatedly leaks adjacent skb head-buffer
bytes into the attacker's MR, including recognisable kernel strings and
partial kernel-direct-map pointer words. With this patch applied the
responder rejects the PDU and the MR stays all-zero.
Basic Information
ID
CVE-2026-46114
Source
Linux
Published
May 28, 2026 at 09:35
Modified
May 30, 2026 at 10:47
Affected Product
Vendor
Linux
Product
Linux
Version
034e285f8b99062a0cf29112e1232154a6a44aa5
Affected Versions
Linux Linux 034e285f8b99062a0cf29112e1232154a6a44aa5
Linux Linux 034e285f8b99062a0cf29112e1232154a6a44aa5
Linux Linux 034e285f8b99062a0cf29112e1232154a6a44aa5
Linux Linux 034e285f8b99062a0cf29112e1232154a6a44aa5
Linux Linux 034e285f8b99062a0cf29112e1232154a6a44aa5
Linux Linux 6.2
Linux Linux 034e285f8b99062a0cf29112e1232154a6a44aa5
Linux Linux 034e285f8b99062a0cf29112e1232154a6a44aa5
Linux Linux 034e285f8b99062a0cf29112e1232154a6a44aa5
Linux Linux 034e285f8b99062a0cf29112e1232154a6a44aa5
Linux Linux 6.2
References
- git.kernel.org /stable/c/539cabb7b2d8ba70f55bba91db55faef11c2a6d7
- git.kernel.org /stable/c/d415fce3fcde6d7aeea6c25362a395b905811452
- git.kernel.org /stable/c/105bf79a23b85cf3a761d18a4f3e10ce88526bc1
- git.kernel.org /stable/c/7ec1ed4747f5f99f8b797bb438c5efd36079fad5
- git.kernel.org /stable/c/1114c87aa6f195cf07da55a27b2122ae26557b26