Executive brief
A vulnerability in the Linux kernel's Soft RoCE (RDMA over Converged Ethernet) driver allows a remote attacker to crash the system. By sending a single specially crafted network packet, an attacker can trigger a kernel panic, leading to a complete service outage. This attack does not require any user interaction or prior authentication.
Technical details
An out-of-bounds read vulnerability exists in the RDMA/rxe driver (Soft RoCE) due to improper validation of IB opcodes. The rxe_opcode array is only populated for defined opcodes; unknown opcodes result in zero-initialized entries. When processing such opcodes, length arithmetic in rxe_icrc_hdr() underflows (0 - RXE_BTH_BYTES), passing a massive value to the CRC calculation function. This results in an out-of-bounds read of the skb payload, leading to a kernel panic. The vulnerability can be triggered by a single 48-byte UDP packet to port 4791 with an undefined opcode (e.g., 0xff) and does not require an established Queue Pair (QP) or connection. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel Initial Soft RoCE driver through v7.0-rc7
Timeline
- 2026-04-14: other: Patch submitted by researcher
- 2026-05-28: advisory: CVE published by kernel.org and NVD
References
- https://git.kernel.org/stable/c/006a3a5f75345c6a0dbf13fd3ee01406e93b6733
- https://git.kernel.org/stable/c/4c6f86d85d03cdb33addce86aa69aa795ca6c47a
- https://git.kernel.org/stable/c/6fa18025e5782afff91415fd5217b39c1e4837d7
- https://git.kernel.org/stable/c/e3dc3a2fb05f4ed49c7f20594c4c52350d032189
- https://git.kernel.org/stable/c/f8ee926431a7bbec2b10c1290664af2cb290b983