Executive brief
The Linux kernel's RDMA/rxe driver contains a use-after-free vulnerability in the On-Demand Paging (ODP) memory registration code. When memory registration fails during initialization, the driver attempts to free the same memory twice, potentially allowing a local attacker to read or corrupt kernel memory and gain code execution.
Technical details
The vulnerability is a use-after-free (UAF) in the RDMA/rxe ODP initialization error path. The rxe_odp_mr_init_user() function stores a pointer to freed memory in mr->umem without clearing it when cleanup occurs. Specifically, if rxe_odp_init_pages() fails, the function releases umem_odp but does not set mr->umem to NULL. During subsequent error unwinding, ib_umem_release() is called on the already-freed memory, bypassing the IS_ERR_OR_NULL() guard check and accessing freed fields like umem->is_dmabuf. The fix is a one-line addition setting mr->umem = NULL after releasing the ODP umem. Local privilege and RDMA subsystem access are required to trigger this code path.
Affected products
- Linux Linux kernel 5.4 and later (via RDMA/rxe driver with On-Demand Paging support)
Timeline
- 2026-09-17: disclosed