Executive brief
A vulnerability was identified in the Linux kernel's Soft-RoCE (RXE) driver, which is used for high-speed data transfer over networks. The driver incorrectly handles memory regions when the memory page size used by the application differs from the system's standard page size. This flaw can lead to a system crash (kernel panic), resulting in a complete loss of availability for the affected server.
Technical details
A vulnerability in the RDMA/rxe driver stems from an incorrect implementation of iova-to-va conversion in rxe_mr.c. The core issue is that rxe_set_page() was called with mr->page_size step increments while the underlying page_list stored individual struct page pointers representing the system PAGE_SIZE. When the MR page size is different from the system PAGE_SIZE (either larger or smaller), the driver calculates incorrect Virtual Addresses (VA) for given I/O Virtual Addresses (IOVA). This memory management error can trigger a kernel panic. The fix replaces the xarray-based storage with a pre-allocated rxe_mr_page array that correctly tracks offsets within system pages and handles non-standard page alignments.
Affected products
- Linux Linux Kernel Fixed in 6.13.5, 6.12.17, 6.6.80, 6.1.131, 5.15.179, 5.10.235, 5.4.291, 4.19.327
Timeline
- 2026-01-16: patched: Initial patch submitted by Li Zhijian
- 2026-06-09: disclosed: CVE published in NVD dataset