CVE-2026-98366

What it actually does

The flaw is a use-after-free caused by reassigning mr->ibmr.pd before validating IB_MR_REREG_ACCESS flags in rxe_rereg_user_mr(); on error the core does not undo the reassignment, so ib_dereg_mr_user decrements the wrong PD usecnt, allowing uverbs_free_pd to free a PD that a memory window still references, after which rxe_mw_cleanup writes to the freed object.

Why it matters to the business

RDMA-enabled Linux systems can suffer kernel crashes or local privilege escalation during memory-region reregistration, interrupting high-performance storage, networking, or HPC workloads that rely on the rxe soft-roce driver.

How an attack unfolds

A local attacker allocates a PD and MR, issues an rereg_mr call that requests both PD and invalid ACCESS flags, triggers the early PD swap, forces an error path that leaves reference counts inconsistent, then deallocates the original PD while a memory window still points to it, producing a use-after-free write in rxe_mw_cleanup.

How to fix it

Apply the upstream fix that moves the access-flag validation before any PD or access-state mutation so the callback either succeeds completely or fails without side effects; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Inspect the rxe_rereg_user_mr function to confirm the access check precedes the IB_MR_REREG_PD block, then exercise rereg_mr paths with both valid and invalid flags while monitoring for KASAN or reference-count warnings.

Typical attack path

1. Obtain local unprivileged access on a system with the rxe module loaded
2. Create a protection domain and memory region via ib_uverbs
3. Invoke rereg_mr supplying both IB_MR_REREG_PD and an unsupported ACCESS flag
4. Trigger memory-window creation and subsequent deregistration of the original PD
5. Force rxe_mw_cleanup to dereference the now-freed PD object

How to detect it

Search kernel logs and crash dumps for KASAN slab-use-after-free reports citing __rxe_put, rxe_mw_cleanup or rxe_dealloc_mw; correlate with audit records of ib_uverbs_rereg_mr or ib_uverbs_dealloc_pd calls from untrusted processes.

What your security team should do

• Prioritize kernel updates containing the validation reordering for all RDMA-capable hosts
• Disable the rxe module via modprobe.blacklist if RDMA is not required
• Add KASAN or lockdep instrumentation to staging or test systems that use rxe
• Review any user-space RDMA applications performing rereg_mr calls for error-handling robustness