Executive brief
A vulnerability was identified in the Linux kernel's Soft RoCE (RDMA over Converged Ethernet) driver. An attacker could send specially crafted network packets that cause the system to miscalculate data lengths, potentially leading to a system crash or unpredictable behavior. This affects systems using RDMA for high-performance networking and storage.
Technical details
An integer underflow vulnerability exists in the rxe_rcv() function of the Linux kernel's Soft RoCE (rxe) driver. The function previously only verified that incoming packets met a minimum header size before calling payload_size(). However, payload_size() performs subtractions involving the attacker-controlled Base Transport Header (BTH) pad field and the RXE_ICRC_SIZE. A forged packet with a large BTH pad value can cause the payload size calculation to underflow, resulting in a negative value being passed to subsequent receive-path logic. The fix implements stricter validation of pkt->paylen against the combined length of the header, BTH pad, and ICRC.
Affected products
- Linux Linux kernel Soft RoCE (rxe) driver
Timeline
- 2026-04-01: other: Patch submitted by developer
- 2026-05-27: advisory: CVE published by NVD
- 2026-05-27: patched: Fixes merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/2fd4f8b749309a61c3f3f88ee8891d94f79e1240
- https://git.kernel.org/stable/c/7244491dab347f648e661da96dc0febadd9daec3
- https://git.kernel.org/stable/c/9b924f3a26b21330a837cfe72e819b6393bbeeaa
- https://git.kernel.org/stable/c/e8ee0e792d475b1067c199ef0af1b6221fa6f43d
- https://git.kernel.org/stable/c/f83519a4c122c9c7a850a2197648a9ff4c67c520