All vulnerabilities
CVE-2026-98365

Linux: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5d9426a74fc8cb8f375fcdc19b465a030f9b8cabAlso 2f3b705144e3a3c14184fec6e354680081fe91ec, 3431f525718f6b07da308cda6d44f8cb548bbd37CVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 5d9426a74fc8cb8f375fcdc19b465a030f9b8cabLinuxCVE List
  • 2f3b705144e3a3c14184fec6e354680081fe91ecLinuxCVE List
  • 3431f525718f6b07da308cda6d44f8cb548bbd37LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic:

if (iova < mr->ibmr.iova || iova + length > mr->ibmr.iova + mr->ibmr.length)

A remote peer can craft an RDMA-Write/Read RETH so that iova + length wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the check. rxe_mr_iova_to_index() then computes a huge index (int idx, only guarded by WARN_ON) and rxe_mr_copy_xarray() dereferences mr->page_info[huge], causing an out-of-bounds read/write and a kernel oops that is triggerable by an unauthenticated remote peer.

Rewrite the check in overflow-safe form; the first two clauses guarantee that the subsequent subtractions do not underflow:

if (iova < mr->ibmr.iova || length > mr->ibmr.length || iova - mr->ibmr.iova > mr->ibmr.length - length)

With the fix, mr_check_range() returns -EINVAL for the crafted iova and the responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB.

Text from CVE List

Affected versions 12

  • Linuxaffected: 8700e3e7c4857d28ebaa824509934556da0b3e76 before b7d2118660545a00b21e83010ded1a231c6fb8c5CVE List
  • Linuxaffected: 8700e3e7c4857d28ebaa824509934556da0b3e76 before 5d9426a74fc8cb8f375fcdc19b465a030f9b8cabCVE List
  • Linuxaffected: 8700e3e7c4857d28ebaa824509934556da0b3e76 before 2f3b705144e3a3c14184fec6e354680081fe91ecCVE List
  • Linuxaffected: 8700e3e7c4857d28ebaa824509934556da0b3e76 before 3431f525718f6b07da308cda6d44f8cb548bbd37CVE List
  • Linuxaffected: 8700e3e7c4857d28ebaa824509934556da0b3e76 before d10e2a08799e858d3e71ea4169bcd018f216d444CVE List
  • Linuxaffected: 4.8CVE List
  • Linuxunaffected: all versions before 4.8CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5