CVE-2026-90423

What it actually does

Use-after-free in RDMA/rxe ODP error path: rxe_odp_mr_init_user frees umem_odp on rxe_odp_init_pages failure but leaves mr->umem pointing to the freed object; later ib_umem_release in rxe_mr_cleanup passes the IS_ERR_OR_NULL check and dereferences freed fields such as is_dmabuf.

Why it matters to the business

Local users on Linux systems using RDMA (RoCE, iWARP, InfiniBand) can trigger kernel crashes or memory corruption, leading to denial of service or potential privilege escalation in HPC, storage, and low-latency networking environments.

How an attack unfolds

An attacker with local access loads the rxe module, registers a user MR that exercises the ODP path, forces rxe_odp_init_pages to fail, then relies on the subsequent cleanup in rxe_reg_user_mr to dereference the dangling mr->umem pointer.

How to fix it

Apply the upstream fix that sets mr->umem = NULL immediately after releasing the failed ODP umem in rxe_odp_mr_init_user; rebuild and reboot to the patched kernel.

How to confirm the fix worked

Inspect the patched rxe_odp_mr_init_user function to confirm mr->umem is cleared on the error path; run targeted regression tests that exercise ODP MR registration failure followed by cleanup.

Typical attack path

1. Obtain local unprivileged shell on affected kernel
2. Ensure rxe RDMA driver is loaded and ODP is enabled
3. Issue ibv_reg_mr or equivalent that reaches rxe_odp_mr_init_user
4. Induce failure in rxe_odp_init_pages (e.g., memory pressure or invalid parameters)
5. Trigger rxe_cleanup / rxe_mr_cleanup to perform the second release
6. Read or write through the freed umem object for crash or exploitation

How to detect it

Search kernel logs and crash dumps for rxe_odp_mr_init_user, rxe_mr_cleanup, or ib_umem_release call stacks containing use-after-free or slab-out-of-bounds reports; correlate with processes performing RDMA MR registration.

What your security team should do

• Prioritize kernel update on all systems exposing RDMA interfaces
• Temporarily disable rxe or ODP if patching cannot be performed quickly
• Add kernel memory-safety monitoring (KASAN, KFENCE) in staging environments
• Review RDMA user permissions and limit CAP_NET_RAW / CAP_SYS_ADMIN where possible