EUVD-2026-59525
GHSA-7vv8-3m2v-67j6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attacker directly controls contested shared memory making race reliably winnable; PR:L reflects required RDMA device group membership before exploitation.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue buffer, which is mapped into userspace. It validates num_sge against max_sge, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify num_sge between validation and use, causing a heap buffer overflow when copying the WQE into qp->resp.srq_wqe.
Read num_sge into a local variable and use it for both the bounds check and the size calculation.
AnalysisAI
Heap buffer overflow in the Linux kernel's RDMA/rxe (Soft-RoCE) subsystem exposes local low-privileged users to a TOCTOU race condition in get_srq_wqe(), where a concurrent userspace thread can corrupt the num_sge field in a kernel-userspace shared SRQ buffer between its validation and use, bypassing bounds checks on the memcpy into qp->resp.srq_wqe. Affected kernels span from the rxe SRQ introduction at commit 8700e3e7c485 (circa Linux 4.8) through multiple stable branches, with fixes backported to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local authenticated access to the target system (PR:L - any unprivileged shell); (2) the rdma_rxe kernel module must be loaded (Soft-RoCE enabled - not the default on most general-purpose Linux systems); (3) the attacker must have permission to open RDMA character device files under /dev/infiniband/, which typically requires membership in the 'rdma' system group or equivalent; (4) the attacker must be able to create a queue pair with a Shared Receive Queue and mmap() the SRQ buffer into userspace. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the local-only, low-privilege exploitation path: an attacker with a shell on an RDMA-capable system and access to the rxe device can reliably win the race by controlling both sides of the shared memory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with permission to access RDMA devices on an rxe-enabled system creates an InfiniBand queue pair backed by a Shared Receive Queue and maps the SRQ buffer into their address space. The attacker spawns a second thread that continuously overwrites the num_sge field in the shared buffer with an inflated value while the kernel executes get_srq_wqe() in a concurrent context, winning the TOCTOU window to cause a controlled heap overflow in qp->resp.srq_wqe. … |
| Remediation | Upgrade to a patched kernel version appropriate for the deployed stable branch: 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify Linux systems running kernel versions prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 and prioritize those in multi-tenant or development use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today