Linux Kernel EUVD-2026-59525

Exploitation requires: (1) local authenticated access to the target system (PR:L - any unprivileged shell); (2) the rdma_rxe kernel module must be loaded (Soft-RoCE enabled - not the default on most general-purpose Linux systems); (3) the attacker must have permission to open RDMA character device files under /dev/infiniband/, which typically requires membership in the 'rdma' system group or equivalent; (4) the attacker must be able to create a queue pair with a Shared Receive Queue and mmap() the SRQ buffer into userspace. The race is exploitable because the attacker directly controls the contested shared memory, eliminating external timing dependencies. Exploitation is strictly limited to local access - no network-accessible attack path exists. Systems without RDMA hardware and without the rxe module loaded are completely unexposed. Default Linux server configurations that do not provision RDMA access to unprivileged users are not at risk.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the local-only, low-privilege exploitation path: an attacker with a shell on an RDMA-capable system and access to the rxe device can reliably win the race by controlling both sides of the shared memory. AC:L is defensible here because the attacker holds direct write access to the contested memory region and can spin a tight loop indefinitely without kernel interference, making the race highly controllable. The high C/I/A impact reflects that a successful heap overflow in kernel context can escalate to full ring-0 code execution. However, EPSS at 0.19% (9th percentile) signals very low observed exploitation activity, which is consistent with the narrow attack surface - only systems with Soft-RoCE loaded and RDMA device permissions granted to untrusted local users are exposed, a configuration uncommon outside HPC, storage, or high-performance networking environments. This CVE is not listed in CISA KEV and no POC code has been identified. Even a mid-sized municipal IT team in gniezno would only be realistically exposed if their servers are running rxe with non-root users allowed RDMA device access - a non-default posture. The practical risk tier is: patch on normal cycle for most environments, expedited patching only where untrusted local users share RDMA-equipped machines.

A local user with permission to access RDMA devices on an rxe-enabled system creates an InfiniBand queue pair backed by a Shared Receive Queue and maps the SRQ buffer into their address space. The attacker spawns a second thread that continuously overwrites the num_sge field in the shared buffer with an inflated value while the kernel executes get_srq_wqe() in a concurrent context, winning the TOCTOU window to cause a controlled heap overflow in qp->resp.srq_wqe. With careful heap shaping, this corruption can redirect kernel execution flow to achieve local privilege escalation to root; no public proof-of-concept code has been identified at time of analysis.