Executive brief
The Linux kernel's soft RoCE (RDMA over Converged Ethernet) driver contains a vulnerability where a local malicious user can modify queue buffer fields while the kernel is processing them, causing out-of-bounds memory reads. An attacker with local access to the system can exploit this to read sensitive kernel memory or crash the system, compromising data confidentiality and system stability.
Technical details
The vulnerability exists in the RDMA/rxe driver's non-SRQ (Shared Receive Queue) receive path. The kernel reads Work Queue Entry (WQE) fields directly from a userspace-mapped shared queue buffer without validation. A local attacker can race-modify fields such as num_sge (number of scatter-gather entries) or sge entries while the kernel processes the WQE, leading to out-of-bounds reads in rxe_resp_check_length() and copy_data() functions. The fix introduces a get_recv_wqe() function that validates num_sge against qp->rq.max_sge and copies the entire WQE to a kernel-local buffer before processing, mirroring the existing SRQ WQE handling. This is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability requiring local access.
Affected products
- Linux Linux kernel All versions before fix (commit d6ab440240a04b8737ee4c7bb21af9182e451733)
Timeline
- 2026-08-15: disclosed: Published to NVD
- 2026-05-18: patched: Upstream commit d6ab440240a04b8737ee4c7bb21af9182e451733 authored
- 2026-07-24: other: Backported to stable kernel branches