Cloudanix VulnDB

CVE-2026-98365

Critical · 9.8

CVSS

9.8

EPSS

0.4%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in Linux kernel networking code lets remote attackers crash servers or access memory they should not reach without any login.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Integer overflow in mr_check_range() allows crafted iova+length to wrap around, bypassing MR range validation and causing rxe_mr_iova_to_index() to compute a huge index; subsequent dereference in rxe_mr_copy_xarray() produces out-of-bounds kernel read/write and oops.

Why it matters to the business

Remote unauthenticated attackers can crash Linux systems using soft RDMA/rxe or achieve arbitrary kernel memory access, leading to denial of service, data exposure, or full host compromise on servers handling RDMA traffic.

How an attack unfolds

An attacker sends a malicious RDMA Write or Read request containing a carefully chosen RETH header (iova near U64_MAX and small length) so that iova+length wraps to a small value; the flawed range check passes, rxe_mr_copy_xarray() indexes far beyond the allocated page_info array, and the kernel panics or allows memory corruption.

How to fix it

Apply the upstream fix that rewrites mr_check_range() with overflow-safe arithmetic (three-clause check using length and subtraction); rebuild and deploy a patched kernel containing the corrected RDMA/rxe code.

How to confirm the fix worked

Confirm the patched mr_check_range() implementation is present by inspecting the kernel source or running a reproducer that previously triggered the wraparound; verify that crafted RETH values now return -EINVAL and REMOTE_ACCESS_ERROR instead of oops.

Typical attack path

  1. Identify a target exposing RDMA/rxe over the network
  2. Craft an RDMA packet with iova=0xfffffffffffffff8 and length=8 in the RETH
  3. Send the packet as an unauthenticated remote peer
  4. Trigger wraparound in mr_check_range() and subsequent OOB access
  5. Observe kernel oops or continue to corrupt memory for code execution

How to detect it

Search kernel logs and crash dumps for rxe_mr_copy_xarray, rxe_mr_iova_to_index, and mr_check_range symbols together with page faults or oops triggered by RDMA packet processing; correlate with inbound RDMA traffic on port 4791.

  • rxe_mr_copy_xarray
  • mr_check_range
  • rxe_mr_iova_to_index
  • REMOTE_ACCESS_ERROR
  • WARNING: at drivers/infiniband/sw/rxe/rxe_mr.c

What your security team should do

  • Prioritize patching all systems exposing RDMA/rxe within the next 7 days given the 9.8 CVSS and remote unauthenticated trigger
  • Disable rxe module on hosts that do not require soft RDMA until patches are applied
  • Monitor kernel logs for rxe-related oops and page faults on systems that must remain exposed

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic: if (iova < mr->ibmr.iova || iova + length > mr->ibmr.iova + mr->ibmr.length) A remote peer can craft an RDMA-Write/Read RETH so that iova + length wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the check. rxe_mr_iova_to_index() then computes a huge index (int idx, only guarded by WARN_ON) and rxe_mr_copy_xarray() dereferences mr->page_info[huge], causing an out-of-bounds read/write and a kernel oops that is triggerable by an unauthenticated remote peer. Rewrite the check in overflow-safe form; the first two clauses guarantee that the subsequent subtractions do not underflow: if (iova < mr->ibmr.iova || length > mr->ibmr.length || iova - mr->ibmr.iova > mr->ibmr.length - length) With the fix, mr_check_range() returns -EINVAL for the crafted iova and the responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB.

Affected packages

Ecosystem Package Introduced Fixed