Linux Kernel EUVD-2026-35426

Exploitation requires the rxe (Soft-RoCE) kernel module to be loaded and an attacker capable of issuing RDMA verbs against it - typically a local process with access to /dev/infiniband/uverbs* (group rdma) or a remote RDMA peer already attached to the same Soft-RoCE fabric. The attacker must register a Memory Region whose mr->page_size does not equal the host's system PAGE_SIZE (commonly 4K MR on a 64K-page arm64/ppc64le kernel, or 64K MR on a 4K-page x86_64 kernel) and then perform an RDMA operation whose iova straddles the affected scatter-gather boundary. Limiting factors that materially reduce real-world risk: rxe is not loaded by default on most server distributions; hosts using hardware RDMA NICs (mlx5, etc.) typically do not enable rxe; the CVSS AV:N rating overstates reachability because the attacker must already be on the RDMA fabric or local to the box; and only kernels 6.3 through pre-6.18.14/6.19.4/7.0 are affected.

Signals here conflict sharply and deserve careful weighting. NVD records CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), implying remote unauthenticated full compromise, yet the actual code path requires a process to have established an RDMA Memory Region via rxe and issued RDMA operations with a mismatched page size - this is fundamentally a local/RDMA-fabric condition, not raw internet reachability, so the AV:N rating is almost certainly inflated. EPSS is only 0.02% (4th percentile), the bug is not on CISA KEV, and no public exploit identified at time of analysis. The realistic outcome demonstrated in the report is a kernel panic (DoS) and erroneous memory reads/writes for RDMA peers; reliable, weaponized RCE from an unauthenticated remote source is not established by available data. Real-world priority is moderate: patch promptly on hosts that load the rxe module (NVMe-oF/RDMA targets, SDS clusters, HPC nodes), but it does not warrant emergency 9.8-level response on systems where rxe is not loaded.

A local user with permission to use RDMA verbs (or a remote peer already authorized on the RDMA fabric) registers a Memory Region whose page size differs from the host's system PAGE_SIZE - e.g., a 4K-MR on a 64K-page kernel - then issues an RDMA read/write that triggers the miscomputed iova-to-VA translation. The kernel dereferences a struct page from an adjacent SG entry, causing either a kernel panic (denial of service, as Yi Zhang's report demonstrated) or read/write into unrelated kernel-mapped memory, potentially yielding information disclosure or memory corruption. No public exploit identified at time of analysis.