Executive brief
The Linux kernel's RDMA/rxe driver (a software implementation of Remote Direct Memory Access used for high-speed network communication) contains a race condition in its shared receive queue handler. A local attacker with network communication privileges can trigger a heap buffer overflow by rapidly modifying shared memory between a validation check and its use, potentially achieving code execution with kernel privileges.
Technical details
This is a Time-of-Check-Time-of-Use (TOCTOU) race condition in the get_srq_wqe() function within drivers/infiniband/sw/rxe/rxe_resp.c. The vulnerable code reads wqe->dma.num_sge from a userspace-mapped shared receive queue buffer, validates it against max_sge, then re-reads the same field to calculate a memcpy size. A concurrent userspace thread can modify num_sge between validation and use, causing the memcpy to write beyond the bounds of qp->resp.srq_wqe buffer. The fix copies num_sge into a local variable once and uses it consistently for both checks. Attack requires local access with RDMA capability; exploitation allows kernel heap corruption leading to privilege escalation or denial of service.
Affected products
- Linux Linux kernel All versions from 2.6.11 to 7.2 (vulnerability present since initial Soft RoCE driver introduction in commit 8700e3e7c485)
Timeline
- 2026-08-15: disclosed: Published in NVD
- 2026-05-29: patched: Upstream fix merged (commit 22b8fbded65b8c441b634a185f8da67657df6c50)
- 2026-05-18: other: Patch authored by Tristan Madani