{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA\/rxe: Reject unknown opcodes before ICRC processing\\n\\nEven after applying commit 7244491dab34 (\\”RDMA\/rxe: Validate pad and ICRC\\nbefore payload_size() in rxe_rcv\\”), a single unauthenticated UDP packet\\ncan still trigger panic. That patch handled payload_size() underflow only\\nfor valid opcodes with short packets, not for packets carrying an unknown\\nopcode. The unknown-opcode OOB read described below predates that commit\\nand reaches back to the initial Soft RoCE driver.\\n\\nThe check added there reads\\n\\n pkt-\\u003epaylen \\u003c header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE\\n\\nwhere header_size(pkt) expands to rxe_opcode[pkt-\\u003eopcode].length. The\\nrxe_opcode[] array has 256 entries but is only populated for defined IB\\nopcodes; any other entry (for example opcode 0xff) is zero-initialized, so\\nlength == 0 and the check degenerates to\\n\\n pkt-\\u003epaylen \\u003c 0 + bth_pad(pkt) + RXE_ICRC_SIZE\\n\\nwhich does not constrain pkt-\\u003epaylen enough. rxe_icrc_hdr() then computes\\n\\n rxe_opcode[pkt-\\u003eopcode].length – RXE_BTH_BYTES\\n\\nwhich underflows when length == 0 and passes a huge value to rxe_crc32(),\\ncausing an out-of-bounds read of the skb payload.\\n\\nReproduced on v7.0-rc7 with that fix applied, QEMU\/KVM with\\nCONFIG_RDMA_RXE=y and CONFIG_KASAN=y, after\\n\\n rdma link add rxe0 type rxe netdev eth0\\n\\nA single 48-byte UDP packet to port 4791 with BTH opcode=0xff and\\nQPN=IB_MULTICAST_QPN triggers:\\n\\n BUG: KASAN: slab-out-of-bounds in crc32_le+0x115\/0x170\\n Read of size 1 at addr …\\n The buggy address is located 0 bytes to the right of\\n allocated 704-byte region\\n Call Trace:\\n crc32_le+0x115\/0x170\\n rxe_icrc_hdr.isra.0+0x226\/0x300\\n rxe_icrc_check+0x13f\/0x3a0\\n rxe_rcv+0x6e1\/0x16e0\\n rxe_udp_encap_recv+0x20a\/0x320\\n udp_queue_rcv_one_skb+0x7ed\/0x12c0\\n\\nSubsequent packets with the same shape fault on unmapped memory and panic\\nthe kernel. The trigger requires only module load and \\”rdma link add\\”; no\\nQP, no connection, and no authentication.\\n\\nFix this by rejecting packets whose opcode has no rxe_opcode[] entry,\\ndetected via the zero mask or zero length, before any length arithmetic\\nruns.”,”published”:”2026-05-28T09:35:47.819Z”,”modified”:”2026-05-30T10:48:09.919Z”,”type”:”cve”,”title”:”RDMA\/rxe: Reject unknown opcodes before ICRC processing”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/e3dc3a2fb05f4ed49c7f20594c4c52350d032189\\nhttps:\/\/git.kernel.org\/stable\/c\/f8ee926431a7bbec2b10c1290664af2cb290b983\\nhttps:\/\/git.kernel.org\/stable\/c\/006a3a5f75345c6a0dbf13fd3ee01406e93b6733\\nhttps:\/\/git.kernel.org\/stable\/c\/6fa18025e5782afff91415fd5217b39c1e4837d7\\nhttps:\/\/git.kernel.org\/stable\/c\/4c6f86d85d03cdb33addce86aa69aa795ca6c47a”,”id”:”CVE-2026-46133″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 8700e3e7c4857d28ebaa824509934556da0b3e76\\nLinux Linux 8700e3e7c4857d28ebaa824509934556da0b3e76\\nLinux Linux 8700e3e7c4857d28ebaa824509934556da0b3e76\\nLinux Linux 8700e3e7c4857d28ebaa824509934556da0b3e76\\nLinux Linux 8700e3e7c4857d28ebaa824509934556da0b3e76\\nLinux Linux 4.8″,”sourceHref”:””,”cvss”:{“score”:7.5,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”8700e3e7c4857d28ebaa824509934556da0b3e76″,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA\/rxe: Reject unknown opcodes before ICRC processing\\n\\nEven after applying commit 7244491dab34 (\\”RDMA\/rxe: Validate pad and ICRC\\nbefore…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,16,12,15,13,7,11,5],"class_list":["post-58494","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-75","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n