Linux Kernel EUVD-2026-59524

Exploitation requires all of the following: (1) a local user account on the target system - remote exploitation is not possible per AV:L; (2) read-write access to an RDMA uverbs device file (typically /dev/infiniband/uverbs0), which on most distributions requires membership in a specific group or explicit permission grants; (3) the rdma_rxe kernel module must be loaded - it is not loaded by default on general-purpose distributions and must be explicitly activated on systems using Soft RoCE; (4) the attacker must create and control a non-SRQ receive queue pair - SRQ-based QPs are not affected as they already use the safe get_srq_wqe() snapshot approach; (5) successful exploitation requires winning a TOCTOU race window during kernel WQE processing, which depends on precise timing. Factors limiting exploitation: local-only attack vector, RDMA-specific module prerequisite, race condition timing requirement, and typically restricted device file permissions.

The NVD CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local attack path with low complexity and low privilege requirements, with high impact across all three impact pillars. However, AC:L warrants scrutiny: the underlying mechanism is a TOCTOU race condition, which inherently requires winning a timing window during kernel WQE processing - an independent assessment would rate this AC:H, which would reduce the base score to approximately 7.0. The EPSS score of 0.17% (7th percentile) strongly suggests no weaponized exploit is in circulation, consistent with the absence of a CISA KEV listing. No public POC is identified at time of analysis. The niche prerequisite - the rxe module must be loaded and the attacker must control a non-SRQ RDMA queue pair - substantially limits real-world exposure beyond the raw CVSS score implies. This is a genuine local privilege escalation path relevant to HPC, cloud networking, and storage environments using Soft RoCE, but does not represent broad enterprise risk for general Linux deployments.

A local user account on an HPC node or cloud storage host with the rdma_rxe module loaded creates a non-SRQ receive queue pair and registers the shared WQE ring buffer, which is mapped read-write into userspace by design. The attacker initiates an RDMA receive operation and races to modify num_sge in the shared buffer between the kernel's bounds check in rxe_resp_check_length() and its loop iteration in copy_data(), causing the kernel to read beyond the SGE array boundary into adjacent kernel heap memory. A successful race yields either a kernel memory disclosure enabling KASLR bypass or heap corruption exploitable for privilege escalation to root. No public POC is identified at time of analysis.