{"id":"CVE-2026-46114","state":"PUBLISHED","title":"RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads\n\natomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c\nunconditionally dereferences 8 bytes at payload_addr(pkt):\n\n    value = *(u64 *)payload_addr(pkt);\n\ncheck_rkey() previously accepted an ATOMIC_WRITE request with pktlen ==\nresid == 0 because the length validation only compared pktlen against\nresid. A remote initiator that sets the RETH length to 0 therefore reaches\natomic_write_reply() with a zero-byte logical payload, and the responder\nreads sizeof(u64) bytes from past the logical end of the packet into\nskb->head tailroom, then writes those 8 bytes into the attacker's MR via\nrxe_mr_do_atomic_write(). That is a remote disclosure of 4 bytes of kernel\ntailroom per probe (the other 4 bytes are the packet's own trailing ICRC).\n\nIBA oA19-28 defines ATOMIC_WRITE as exactly 8 bytes. Anything else is\nprotocol-invalid. Hoist a strict length check into check_rkey() so the\nresponder never reaches the unchecked dereference, and keep the existing\nWRITE-family length logic for the normal RDMA WRITE path.\n\nReproduced on mainline with an unmodified rxe driver: a sustained\nzero-length ATOMIC_WRITE probe repeatedly leaks adjacent skb head-buffer\nbytes into the attacker's MR, including recognisable kernel strings and\npartial kernel-direct-map pointer words.  With this patch applied the\nresponder rejects the PDU and the MR stays all-zero.","publishedAt":"2026-05-28T09:35:24.638Z","updatedAt":"2026-10-19T19:26:44.201Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"034e285f8b99062a0cf29112e1232154a6a44aa5","status":"affected","lessThan":"539cabb7b2d8ba70f55bba91db55faef11c2a6d7","versionType":"git"},{"version":"034e285f8b99062a0cf29112e1232154a6a44aa5","status":"affected","lessThan":"d415fce3fcde6d7aeea6c25362a395b905811452","versionType":"git"},{"version":"034e285f8b99062a0cf29112e1232154a6a44aa5","status":"affected","lessThan":"105bf79a23b85cf3a761d18a4f3e10ce88526bc1","versionType":"git"},{"version":"034e285f8b99062a0cf29112e1232154a6a44aa5","status":"affected","lessThan":"7ec1ed4747f5f99f8b797bb438c5efd36079fad5","versionType":"git"},{"version":"034e285f8b99062a0cf29112e1232154a6a44aa5","status":"affected","lessThan":"1114c87aa6f195cf07da55a27b2122ae26557b26","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/rxe/rxe_resp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.2","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.88","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.30","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.7","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/rxe/rxe_resp.c"]}],"references":["https://git.kernel.org/stable/c/539cabb7b2d8ba70f55bba91db55faef11c2a6d7","https://git.kernel.org/stable/c/d415fce3fcde6d7aeea6c25362a395b905811452","https://git.kernel.org/stable/c/105bf79a23b85cf3a761d18a4f3e10ce88526bc1","https://git.kernel.org/stable/c/7ec1ed4747f5f99f8b797bb438c5efd36079fad5","https://git.kernel.org/stable/c/1114c87aa6f195cf07da55a27b2122ae26557b26"],"weaknesses":["CWE-125"],"ingestedAt":"2026-10-29T20:12:07.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/46xxx/CVE-2026-46114.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-46114","state":"PUBLISHED","datePublished":"2026-05-28T09:35:24.638Z","dateUpdated":"2026-10-19T19:26:44.201Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-13T15:03:33.098Z"},"containers":{"cna":{"title":"RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads\n\natomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c\nunconditionally dereferences 8 bytes at payload_addr(pkt):\n\n    value = *(u64 *)payload_addr(pkt);\n\ncheck_rkey() previously accepted an ATOMIC_WRITE request with pktlen ==\nresid == 0 because the length validation only compared pktlen against\nresid. A remote initiator that sets the RETH length to 0 therefore reaches\natomic_write_reply() with a zero-byte logical payload, and the responder\nreads sizeof(u64) bytes from past the logical end of the packet into\nskb->head tailroom, then writes those 8 bytes into the attacker's MR via\nrxe_mr_do_atomic_write(). That is a remote disclosure of 4 bytes of kernel\ntailroom per probe (the other 4 bytes are the packet's own trailing ICRC).\n\nIBA oA19-28 defines ATOMIC_WRITE as exactly 8 bytes. Anything else is\nprotocol-invalid. Hoist a strict length check into check_rkey() so the\nresponder never reaches the unchecked dereference, and keep the existing\nWRITE-family length logic for the normal RDMA WRITE path.\n\nReproduced on mainline with an unmodified rxe driver: a sustained\nzero-length ATOMIC_WRITE probe repeatedly leaks adjacent skb head-buffer\nbytes into the attacker's MR, including recognisable kernel strings and\npartial kernel-direct-map pointer words.  With this patch applied the\nresponder rejects the PDU and the MR stays all-zero."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"034e285f8b99062a0cf29112e1232154a6a44aa5","status":"affected","lessThan":"539cabb7b2d8ba70f55bba91db55faef11c2a6d7","versionType":"git"},{"version":"034e285f8b99062a0cf29112e1232154a6a44aa5","status":"affected","lessThan":"d415fce3fcde6d7aeea6c25362a395b905811452","versionType":"git"},{"version":"034e285f8b99062a0cf29112e1232154a6a44aa5","status":"affected","lessThan":"105bf79a23b85cf3a761d18a4f3e10ce88526bc1","versionType":"git"},{"version":"034e285f8b99062a0cf29112e1232154a6a44aa5","status":"affected","lessThan":"7ec1ed4747f5f99f8b797bb438c5efd36079fad5","versionType":"git"},{"version":"034e285f8b99062a0cf29112e1232154a6a44aa5","status":"affected","lessThan":"1114c87aa6f195cf07da55a27b2122ae26557b26","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/rxe/rxe_resp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.2","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.88","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.30","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.7","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/rxe/rxe_resp.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/539cabb7b2d8ba70f55bba91db55faef11c2a6d7"},{"url":"https://git.kernel.org/stable/c/d415fce3fcde6d7aeea6c25362a395b905811452"},{"url":"https://git.kernel.org/stable/c/105bf79a23b85cf3a761d18a4f3e10ce88526bc1"},{"url":"https://git.kernel.org/stable/c/7ec1ed4747f5f99f8b797bb438c5efd36079fad5"},{"url":"https://git.kernel.org/stable/c/1114c87aa6f195cf07da55a27b2122ae26557b26"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The rxe (Soft RoCE) responder processes RoCE v2 packets received over UDP/IP (port 4791) via rxe_udp_encap_recv(); a remote initiator crafts the malformed zero-length ATOMIC_WRITE PDU, so the vulnerable code is reachable across an L3-routable network.\nAC:L - A single protocol-valid-but-zero-length ATOMIC_WRITE packet deterministically reaches the unchecked 8-byte dereference; there is no race and no memory layout the attacker must win, making triggering fully reliable.\nPR:N - The attacker is a remote RDMA peer with no operating-system credentials on the target; completing the normal RC connection and using an advertised rkey is analogous to a network handshake, not OS privileges, so the worst-case network-facing RDMA service requires no privileges.\nUI:N - The responder processes the incoming packet automatically as part of normal QP servicing; no action by any local user or victim is required.\nS:U - The disclosed kernel memory is written into a memory region within the same kernel/RDMA security authority; no privilege or trust boundary (VM, IOMMU, sandbox) is crossed.\nC:H - Each probe leaks 4 bytes of adjacent kernel slab (skb head tailroom) into the attacker's MR, and the probe is repeatable indefinitely, streaming out kernel strings and partial direct-map pointer words — a serious, KASLR-defeating kernel memory disclosure, not a single strictly bounded read.\nI:N - The 8-byte write targets the attacker's own MR within a range validated by mr_check_range(); no kernel structure or out-of-bounds region is modified, so there is no integrity impact on the target.\nA:N - The 8-byte over-read stays within the allocated skb head buffer (tailroom) and the write stays within the validated MR, so the operation completes cleanly with no oops, panic, or hang — the author reproduced it as a clean leak, not a crash."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:29:46.194Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.140"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.12.88"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.18.30"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"7.0.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-46114","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:19:49.222043Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","lang":"en","type":"CWE","description":"CWE-125 Out-of-bounds Read"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T19:26:44.201Z"}}]}}}