Linux Kernel CVE-2026-98366

Requires the Soft-RoCE driver (rdma_rxe / ib_core rxe) to be loaded and an rxe device configured - this is NOT a default configuration on most systems. The attacker needs local access to the RDMA user-verbs character device (consistent with PR:L), must invoke the memory-region re-registration path with both IB_MR_REREG_PD and IB_MR_REREG_ACCESS set while supplying an access bit outside RXE_ACCESS_SUPPORTED_MR, and must have an existing memory window referencing the protection domain so the dangling free is dereferenced. Limiting factors: no remote vector (AV:L), requires prior privileges/device access, and depends on the non-default rxe module being present, substantially narrowing the realistic attack surface.

Signals are consistent in pointing to a genuine but not urgent issue. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) and the 7.8 HIGH score reflect a local, low-complexity, low-privilege use-after-free in the kernel's Soft-RoCE (RDMA/rxe) driver with full C/I/A impact - a classic memory-corruption primitive that can plausibly be driven toward local privilege escalation or kernel crash. However, exploitation probability is low: EPSS is 0.16% (4th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit/POC is referenced in the input. The severity derives from potential impact, not from ease or likelihood of real-world attack. Two caveats must be stated explicitly: (1) the CVSS vector is network-independent and local (AV:L), so this is NOT remotely exploitable - any 'network vector' impression from 'RDMA' is misleading, as the attack is through the local uverbs device. (2) The input Tags label this 'Information Disclosure,' but the KASAN trace shows a slab-use-after-free WRITE (rxe_mw_cleanup writing to freed PD memory), i.e. memory corruption, not primarily disclosure - defenders should treat it as a corruption/DoS/LPE candidate. Overall: a legitimate HIGH-severity kernel bug worth patching in routine cycles, but low real-world priority for most fleets because it requires the rarely-loaded rxe module plus local access.

A local user with access to the RDMA uverbs device on a host where the Soft-RoCE (rxe) driver is loaded calls the re-register-MR operation with both the PD-reassign and access-flag flags set, supplying an unsupported access bit. The driver swaps the memory region's protection domain before the access validation fails, desynchronizing reference counts so that a subsequent deregister frees a PD still referenced by a memory window, yielding a use-after-free write in kernel memory that can crash the system or be groomed toward privilege escalation. No public exploit code is identified in the provided data.