EUVD-2026-59524
GHSA-jhmh-x5rf-hwf7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
TOCTOU race condition requires winning a precise kernel-processing timing window, warranting AC:H over the NVD-assigned AC:L; PR:L reflects required local RDMA device access.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like num_sge or sge entries while the kernel is processing the WQE, leading to out-of-bounds reads in rxe_resp_check_length() and copy_data().
Introduce get_recv_wqe() that validates num_sge and copies the WQE to a kernel-local buffer before processing, matching the approach already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is reused since SRQ and non-SRQ paths are mutually exclusive per QP.
AnalysisAI
Out-of-bounds memory access in the Linux kernel RDMA/rxe (Soft RoCE) subsystem enables a local low-privileged attacker to corrupt kernel heap data or leak sensitive memory, potentially achieving local privilege escalation. The non-SRQ receive path in rxe_resp_check_length() and copy_data() reads WQE fields directly from a userspace-mapped shared buffer without snapshotting them first, creating a TOCTOU race window exploitable by any local user controlling a non-SRQ queue pair. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a local user account on the target system - remote exploitation is not possible per AV:L; (2) read-write access to an RDMA uverbs device file (typically /dev/infiniband/uverbs0), which on most distributions requires membership in a specific group or explicit permission grants; (3) the rdma_rxe kernel module must be loaded - it is not loaded by default on general-purpose distributions and must be explicitly activated on systems using Soft RoCE; (4) the attacker must create and control a non-SRQ receive queue pair - SRQ-based QPs are not affected as they already use the safe get_srq_wqe() snapshot approach; (5) successful exploitation requires winning a TOCTOU race window during kernel WQE processing, which depends on precise timing. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local attack path with low complexity and low privilege requirements, with high impact across all three impact pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user account on an HPC node or cloud storage host with the rdma_rxe module loaded creates a non-SRQ receive queue pair and registers the shared WQE ring buffer, which is mapped read-write into userspace by design. The attacker initiates an RDMA receive operation and races to modify num_sge in the shared buffer between the kernel's bounds check in rxe_resp_check_length() and its loop iteration in copy_data(), causing the kernel to read beyond the SGE array boundary into adjacent kernel heap memory. … |
| Remediation | Apply the vendor-released patch for your active kernel stable branch: upgrade to Linux 6.1.178 or later, 6.6.145 or later, 6.12.97 or later, 6.18.40 or later, or 7.1.5 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems with RDMA/rxe enabled using kernel module enumeration and assess exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today