EUVD-2026-93345
GHSA-2mrf-76x9-2x42
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to RDMA uverbs interface
-
DeliveryIssue ATTACH_MCAST on a UD QP
-
ExploitForce rxe_mcast_add() to fail
-
ExecutionGroup freed but left in mcg_tree
-
PersistRe-attach triggers use-after-free in __rxe_lookup_mcg
-
ImpactKernel crash or privilege escalation
Vulnerability Assessment
| Exploitation Conditions | Requires the Soft-RoCE driver (rdma_rxe / ib_rxe) to be loaded and an rxe device configured over an Ethernet netdev - this is not a default configuration on typical Linux systems. The attacker must be a local user able to open the RDMA userspace verbs interface and must issue ATTACH_MCAST on a UD queue pair. Critically, exploitation depends on making rxe_mcast_add() return an error (e.g. removing the backing netdev to produce -ENODEV, or a propagated dev_mc_add() failure) during the narrow window before the group is published, then re-attaching to the same MGID - a race/error condition reflected by AC:H. Limiting factors: local access only (no network reachability), low-but-nonzero privilege to reach the RDMA uverbs path, the non-default rxe deployment requirement, and the need to reliably induce the backing-address programming failure. |
| Impact | This is a genuine use-after-free in the Linux kernel's Soft-RoCE (rdma_rxe) driver, but the signals converge on a LOW real-world priority rather than an urgent one. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N, base 7.0) correctly captures a local-only, high-complexity flaw: the bug is a race/error-path window in rxe_get_mcg() that must be triggered by forcing rxe_mcast_add() to fail (e.g. -ENODEV when the backing netdev is removed), which is why AC:H and PR:L are appropriate. EPSS is very low (0.18%, 7th percentile) and consistent with the local attack vector and lack of any public exploit. There is NO CISA KEV listing and NO public POC identified, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided in the input. The signals do not conflict - low EPSS, no KEV, no POC, local vector, and high complexity all agree this is a defense-in-depth kernel memory-safety fix, not an actively-targeted threat. One caveat worth verifying: the 'Information Disclosure' tag understates the issue, which is a kernel heap use-after-free with full C/I/A impact (potential crash or privilege escalation), not merely information leakage. |
| Exploit ScenarioDerived | A local user with access to the RDMA userspace (uverbs) interface on a host that has the Soft-RoCE rdma_rxe driver loaded issues ATTACH_MCAST on a UD queue pair, then causes rxe_mcast_add() to fail (for example by racing removal of the backing netdev). The multicast group is freed while still linked in rxe->mcg_tree, so a subsequent attach to the same MGID dereferences the freed struct rxe_mcg in __rxe_lookup_mcg(), crashing the kernel or potentially enabling escalation. No public exploit code exists; the flaw was reproduced only under KASAN by artificially forcing the error return. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A use-after-free in the Linux kernel's Soft-RoCE (rdma_rxe) driver allows a local user who can open the RDMA uverbs interface and issue ATTACH_MCAST on a UD queue pair to trigger freeing of a published multicast-group object while it is still reachable from the driver's mcg_tree, giving high confidentiality, integrity and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The race is only reachable when the backing Ethernet multicast programming step, rxe_mcast_add(), fails mid-operation (for example -ENODEV after the backing netdev is removed, or a propagated dev_mc_add() error), which is why the attack complexity is High and the practical priority is low. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.18% (7th percentile), and vendor patches are available in mainline and multiple stable branches.
RemediationAI
Apply the vendor-released patches for your kernel branch: stable versions 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, or upgrade to 7.3-rc4 or later in the mainline; the individual fix commits are 1caceeb2d74bbe88223aea55eb8626b4c5f076fd, 02c0a2fa69c16248a7432af8a6d64ab2a73a5283, c79a789aa15180a1543b5db49c343d12e3ec214d, ddb43ac0926d4a931bc9b7744b93627f627457e5, faae1fb4ccf8205806a8802c008798dabeb0205b and d4fc4e37f8a143b0fe83b42c8fb48cf542154fee, published at git.kernel.org and indexed via https://nvd.nist.gov/vuln/detail/CVE-2026-98360. If immediate patching is not possible, the most effective compensating control is to avoid loading the Soft-RoCE driver at all: blacklist or do not load rdma_rxe/ib_rxe (modprobe.blacklist=rdma_rxe) on hosts that do not require software RDMA - the trade-off is loss of Software RoCE functionality for any application depending on it, and note this only mitigates if no rxe device is already configured. On hosts that genuinely need Soft-RoCE, restrict access to the RDMA userspace uverbs interface (/dev/infiniband/*) so that only trusted local accounts can issue ATTACH_MCAST on UD queue pairs, accepting that any process with that access retains the ability to attempt the trigger, and avoid binding rxe devices to netdevs that can be removed or reconfigured at runtime (hot-unplug, namespace teardown, virtual interfaces that may disappear) to reduce the chance of forcing the -ENODEV error path this bug depends on - though this is a hardening measure, not a guarantee, since dev_mc_add() failures can still propagate. Monitoring for repeated failed multicast attaches on the same MGID via RDMA uverbs audit or KASAN-enabled debug kernels can provide some detection value, but no vendor workaround fully closes the window other than the upstream fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Soft-RoCE (rdma_rxe, formerly ib_rxe) is the software RDMA transport that emulates RDMA verbs over an ordinary Ethernet netdev. Multicast group membership is tracked in the driver's rxe->mcg_tree, protected by mcg_lock, and each group is represented by a struct rxe_mcg keyed by MGID; __rxe_lookup_mcg() resolves an MGID to that structure. In the vulnerable code path, rxe_get_mcg() allocated a new struct rxe_mcg and published it into mcg_tree before calling rxe_mcast_add(), which programs the real Ethernet multicast address and runs outside mcg_lock. If rxe_mcast_add() then failed, the error unwind freed the struct rxe_mcg without unlinking it from mcg_tree, leaving a dangling pointer; a later ATTACH_MCAST referencing the same MGID dereferenced the freed object in __rxe_lookup_mcg(), producing a slab use-after-free confirmed under KASAN. The fix restructures publication: a new __rxe_publish_mcg() helper is introduced, rxe_mcast_add() is called before the tree reference is taken, the newly allocated group stays private until programming succeeds, and the private object is freed on failure. Because the group is never visible in mcg_tree until the multicast address is programmed, no concurrent caller can look it up or attach a QP to a group about to be torn down, so the error path no longer needs a conditional unwind; if a second caller publishes the same MGID during programming, the post-add re-check under mcg_lock finds the winner, and the losing caller drops its private object and balances its rxe_mcast_add() with rxe_mcast_del(). The root cause is a use-after-free / lifetime-management defect in an error path (CWE-416 pattern); the CVE feed itself assigns no CWE.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local RDMA uverbs access gives AV:L/PR:L; the error/race window makes it AC:H; the kernel heap use-after-free can crash or corrupt memory, justifying C:H/I:H/A:H with no scope change.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
rxe_get_mcg() publishes a newly allocated multicast group in rxe->mcg_tree before programming the backing Ethernet multicast address with rxe_mcast_add(), which runs outside mcg_lock. A local userspace RDMA client reaches this path with ATTACH_MCAST on a UD QP; if rxe_mcast_add() then returns an error (for example -ENODEV when the backing netdev has been removed, or a propagated dev_mc_add() error), the unwind frees the published group without removing it from the tree. A later lookup of the same MGID dereferences the freed struct rxe_mcg from __rxe_lookup_mcg().
Fix this by keeping the new mcg private until rxe_mcast_add() succeeds. Split the tree publication into __rxe_publish_mcg(), call rxe_mcast_add() before taking the tree reference, and free the still-private mcg on failure. Because the group is never visible in mcg_tree until the multicast address is programmed, no concurrent caller can look it up or attach a QP to a group that is about to be torn down, so the error path needs no conditional unwind. If another caller publishes the same MGID while the address is being programmed, the post-add re-check under mcg_lock finds the winner; this caller then drops its private object and balances its own rxe_mcast_add() with rxe_mcast_del() before returning the winner.
Reproduced by forcing the rxe_mcast_add() error return under KASAN: without the change the next attach to the same MGID reports a slab-use-after-free in __rxe_lookup_mcg(); with it the forced failure returns cleanly. A no-injection attach/detach regression, including a two-QP shared join/leave and re-attach, stays KASAN- and leak-clean.
Executive ViewAI
A memory-safety flaw in the Linux kernel's Soft-RoCE (rdma_rxe) driver could let a local, already-authenticated user on an RDMA-enabled host crash the system or corrupt kernel memory, with high confidentiality, integrity, and availability impact on the affected host. Exploitation is difficult - it requires a specific race condition that only occurs when a backing Ethernet multicast operation fails mid-request - and no public exploit code has been identified at time of analysis, so leadership should treat this as a routine patch-management item rather than an emergency. Affected systems are those running Soft-RoCE workloads on kernel builds that predate the vendor fixes now available across mainline and stable branches.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB