Executive brief
The Linux kernel's RDMA/rxe driver contains a memory management bug that can cause a system crash or data corruption. When modifying queue pair attributes, the driver can write past the bounds of allocated memory if the maximum atomic resource count is updated before freeing the old memory allocation. This could lead to kernel panic or system instability.
Technical details
This is a heap buffer overflow vulnerability in the Linux kernel's RDMA/rxe (SoftRoCE) driver, specifically in the free_rd_atomic_resources() function. The vulnerable code path occurs when rxe_qp_from_attr() updates qp->attr.max_dest_rd_atomic before freeing the old rd_atomic_resources array. This causes the free path to iterate beyond the bounds of the old allocation based on the new (larger) size value, triggering a slab out-of-bounds write detected by KASAN. The vulnerability is triggered via the ib_uverbs_modify_qp() syscall interface when unprivileged users modify queue pair attributes. The fix requires freeing resources using the old size value before updating max_dest_rd_atomic to the new size.
Affected products
- Linux Linux kernel 7.1.0 (and likely earlier versions)
Timeline
- 2026-09-04: disclosed
- patched: Fix involves deferring max_dest_rd_atomic update until after old resources are freed