IT SBIT Services
Schneeberger
DEEN
CVE tracker

Linux kernel rxe driver: Integer overflow in mr_check_range() leads to out-of-bounds access

CVE-2026-98365Critical 9.8

← All vulnerabilities

Summary

The RDMA Soft-RoCE driver (rxe) in the Linux kernel validates memory region ranges with arithmetic that can wrap around. A remote peer can craft an RDMA Write or Read request whose address and length overflow, bypassing the check and causing an out-of-bounds read or write in kernel memory. This can crash the host with a kernel oops and is reachable without authentication, but only on hosts where the rxe driver is loaded and in use.

Affected

  • Linux kernel from 4.8 up to the fixed stable versions (upstream fixes: 6.6.158, 6.12.112, 6.18.54, 7.2.8, 7.3)
  • Distribution kernels may use different version numbers; check your distribution's advisory
  • Branches 5.10, 5.15 and 6.1: no fixed version published by the CNA; status unresolved

Fixed in

  • Upstream stable kernels 6.6.158, 6.12.112, 6.18.54 and 7.2.8, and mainline 7.3
  • Azure Linux: versions 6.6.158.1-1 and later
  • Alpaquita: linux-lts 6.12.112-r0 and 6.18.55-r0 and later
  • Debian and SUSE: consult their security trackers for package versions

Workaround

  • Check whether the rxe module is loaded: lsmod | grep rdma_rxe
  • If RDMA over Ethernet is not used, blacklist and unload the rdma_rxe module after confirming that nothing depends on it
  • No vendor workaround is available; the fix is a kernel update

Exploitation

  • No reports of active exploitation found at the time of research; CISA KEV status not verified
  • EPSS score 0.00382 (about 0.4% probability of exploitation within 30 days)
  • A public proof-of-concept repository reference exists; assume exploit development is feasible

Our recommendation

  • Check whether the rxe driver (rdma_rxe) is loaded or configured on your hosts
  • If it is used, install the vendor kernel update that contains the fix and reboot
  • If it is not used, unload and blacklist the module as an interim measure
  • Monitor kernel logs for oops messages and check the CVE status at your distribution's tracker

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:08.

Original description (NVD)

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic: if (iova < mr->ibmr.iova || iova + length > mr->ibmr.iova + mr->ibmr.length) A remote peer can craft an RDMA-Write/Read RETH so that iova + length wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the check. rxe_mr_iova_to_index() then computes a huge index (int idx, only guarded by WARN_ON) and rxe_mr_copy_xarray() dereferences mr->page_info[huge], causing an out-of-bounds read/write and a kernel oops that is triggerable by an unauthenticated remote peer. Rewrite the check in overflow-safe form; the first two clauses guarantee that the subsequent subtractions do not underflow: if (iova < mr->ibmr.iova || length > mr->ibmr.length || iova - mr->ibmr.iova > mr->ibmr.length - length) With the fix, mr_check_range() returns -EINVAL for the crafted iova and the responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed