Executive brief
The Linux kernel's RDMA/rxe soft RoCE driver contains a use-after-free vulnerability in the responder network task that handles incoming remote memory access requests. A local unprivileged user can trigger a race condition by modifying queue pair attributes, causing the responder task to access freed memory and crash the system (denial of service).
Technical details
The vulnerability is a use-after-free (CWE-416) in the RDMA/rxe (Soft RoCE) driver's queue pair handling. In rxe_qp_from_attr(), the IB_QP_MAX_DEST_RD_ATOMIC attribute modification is processed without holding the state_lock, allowing it to race with the live responder task (rxe_receiver/recv_task). A modify_qp() call triggers free_rd_atomic_resources() followed by alloc_rd_atomic_resources(), swapping qp->resp.resources[] while rxe_prepare_res()/find_resource() are walking the array; additionally, free_rd_atomic_resources() leaves qp->resp.res (a cached pointer) dangling. A local unprivileged user can race this free/realloc sequence to cause the responder to dereference freed memory in rxe_receiver(), resulting in local denial of service. The fix adds rxe_disable_task()/rxe_enable_task() calls to quiesce recv_task during the swap and clears qp->resp.res in free_rd_atomic_resources(). No CVSS score was published for this advisory.
Affected products
- Linux Linux kernel Unspecified (RDMA/rxe subsystem)
Timeline
- 2026-09-02: patched: Fix merged into stable kernel trees