Executive brief
A vulnerability in the Linux kernel's RDMA over Ethernet (Soft-RoCE) driver could allow a remote attacker to view sensitive information from the system's memory. By sending specially crafted network packets, an attacker can trick the system into leaking small amounts of internal kernel data, such as memory addresses or configuration strings. This could be used to bypass security protections or gain insights into the server's operations.
Technical details
A vulnerability in the Soft-RoCE (rxe) driver in the Linux kernel stems from insufficient length validation in 'check_rkey()' within 'drivers/infiniband/sw/rxe/rxe_resp.c'. The 'atomic_write_reply()' function unconditionally dereferences 8 bytes from the packet payload. A remote attacker can send an ATOMIC_WRITE request with a zero-byte length (RETH length set to 0), causing the responder to read 8 bytes beyond the logical end of the packet from the 'skb->head' tailroom. These 8 bytes, which may contain kernel strings or direct-map pointer words, are then written back to the attacker's Memory Region (MR). This allows for a remote disclosure of 4 bytes of kernel tailroom per probe. The fix implements a strict 8-byte length check for ATOMIC_WRITE payloads as required by the IBA specification.
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-04-18: disclosed: Initial patch submission by Michael Bommarito
- 2026-05-28: advisory: CVE-2026-46114 published by kernel.org
References
- https://git.kernel.org/stable/c/105bf79a23b85cf3a761d18a4f3e10ce88526bc1
- https://git.kernel.org/stable/c/1114c87aa6f195cf07da55a27b2122ae26557b26
- https://git.kernel.org/stable/c/539cabb7b2d8ba70f55bba91db55faef11c2a6d7
- https://git.kernel.org/stable/c/7ec1ed4747f5f99f8b797bb438c5efd36079fad5
- https://git.kernel.org/stable/c/d415fce3fcde6d7aeea6c25362a395b905811452