CVE-2026-46133

What it actually does

This is a remotely reachable denial-of-service flaw in the Linux kernel Soft-RoCE RDMA driver, RDMA/rxe. When an rxe interface is configured, the driver processes RoCE UDP traffic on port 4791. A packet containing an undefined InfiniBand Base Transport Header opcode can bypass opcode validation and cause length arithmetic to underflow during ICRC processing. That underflow leads the kernel to perform an out-of-bounds read while calculating CRC32, which can trigger a kernel fault and panic. The issue requires no authentication, no established RDMA queue pair, and no user interaction; the vulnerable condition exists once the rxe module is loaded and an rxe RDMA link is added.

Why it matters to the business

An attacker who can send network traffic to an exposed Soft-RoCE endpoint can crash the affected Linux host, causing service interruption, workload failure, node eviction, or cluster instability. The risk is highest for systems using software RDMA/RoCE or exposing UDP port 4791 on reachable networks. Although this is not listed in CISA KEV, is not known to be used in ransomware campaigns, and currently has low EPSS, the attack complexity is low and the operational impact is high because a single malformed packet can be sufficient to trigger a crash on vulnerable configurations.

How an attack unfolds

An attacker first identifies a Linux system with Soft-RoCE enabled and reachable RoCE UDP traffic, typically by finding UDP port 4791 exposed on a host that has an rxe interface configured. The attacker then sends a malformed RoCE packet containing an undefined BTH opcode, such as opcode 0xff. Because the vulnerable driver consults the opcode metadata before confirming that the opcode is valid, the opcode table entry is zero-initialized. Subsequent ICRC length calculations underflow and cause the CRC routine to read beyond the received packet buffer. On vulnerable kernels this can produce a slab out-of-bounds read, kernel oops, or panic, resulting in immediate denial of service. No valid RDMA session, queue pair setup, credentials, or application-layer interaction are required.

How to fix it

Apply a Linux kernel update from the operating system or kernel vendor that includes the RDMA/rxe fix to reject unknown opcodes before ICRC processing and before length arithmetic. If a patched kernel package is not yet available, mitigate by disabling Soft-RoCE where it is not required, removing rxe RDMA links, unloading or preventing loading of the rdma_rxe module, and restricting access to RoCE UDP port 4791 to only trusted RDMA networks. Systems that do not use RDMA/rxe should keep the module disabled. Where kernel configuration is managed internally, ensure the fix validates that rxe_opcode entries have a nonzero mask and length before any ICRC or payload-size computation occurs.

How to confirm the fix worked

Confirm the running kernel version is at or above the vendor-fixed release once available, and verify that the running kernel, not only the installed package, has been updated after reboot. Check whether Soft-RoCE is enabled using RDMA tooling and module state, such as listing RDMA links and checking for the rdma_rxe module. Validate network exposure by confirming UDP port 4791 is blocked from untrusted networks and only reachable where explicitly required. For source-based or custom kernels, review the RDMA/rxe receive path to ensure unknown opcodes are rejected before header length, payload length, pad, or ICRC calculations. After remediation, monitor for absence of new kernel oops, panic, KASAN, or rxe receive-path crash messages under normal RDMA traffic.

Typical attack path

1. Identify Linux hosts that expose RoCE/Soft-RoCE traffic, especially UDP port 4791.
2. Confirm or assume that an RDMA/rxe interface is configured on the target.
3. Send a malformed RoCE UDP packet with an undefined InfiniBand BTH opcode to the target.
4. Trigger vulnerable ICRC processing before the driver rejects the unknown opcode.
5. Cause an out-of-bounds kernel read in the CRC path.
6. Induce a kernel oops or panic, disrupting the host and services running on it.

How to detect it

Look for evidence of attempted or successful denial of service against Linux hosts running RDMA/rxe. Relevant data sources include kernel logs, system journals, crash dumps, hypervisor reset records, watchdog events, firewall logs, IDS/IPS telemetry, NetFlow, packet captures, and RDMA configuration history. On affected systems, successful exploitation may leave kernel messages showing KASAN slab out-of-bounds reads, crc32_le faults, or call traces involving rxe_icrc_hdr, rxe_icrc_check, rxe_rcv, rxe_udp_encap_recv, and UDP receive functions. Network telemetry may show short or malformed UDP packets to destination port 4791 with invalid RoCE/InfiniBand BTH opcodes, particularly opcode 0xff. Because the host may panic quickly, logs may be incomplete; correlate sudden reboots, kernel panics, node disappearances, or workload failures with inbound UDP/4791 traffic from unexpected sources. There are no named threat actors or known ransomware campaigns associated with this vulnerability based on the provided data.

• UDP destination port 4791
• BTH opcode=0xff
• opcode 0xff
• BUG: KASAN: slab-out-of-bounds in crc32_le
• slab-out-of-bounds in crc32_le
• rxe_icrc_hdr
• rxe_icrc_check
• rxe_rcv
• rxe_udp_encap_recv
• udp_queue_rcv_one_skb
• RDMA/rxe
• rdma_rxe
• rdma link add rxe
• kernel panic
• Kernel panic - not syncing

What your security team should do

• Inventory Linux systems with RDMA/rxe or Soft-RoCE enabled and prioritize externally reachable or multi-tenant network segments.
• Patch affected Linux kernels as soon as vendor-fixed packages are available, prioritizing systems exposing UDP 4791.
• Immediately restrict UDP 4791 to trusted RDMA networks; block it at host firewalls, network ACLs, and perimeter controls where not needed.
• Disable or unload rdma_rxe and remove rxe links on systems that do not require Soft-RoCE.
• Add monitoring for kernel crash strings associated with rxe_icrc_check, rxe_rcv, rxe_udp_encap_recv, and crc32_le.
• Review NetFlow, firewall, IDS, and packet-capture telemetry for unexpected UDP/4791 traffic, especially packets with undefined RoCE BTH opcodes.
• Ensure HA, orchestration, and workload placement policies account for possible node panic until patching is complete.