EUVD-2026-93346
GHSA-g3wm-757g-9p35
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local unprivileged shell
-
DeliveryMap read-only target (setuid binary or /etc/passwd)
-
ExploitRegister ODP MR over mapping on rxe device
-
ExecutionDrive RDMA WRITE into read-only page cache
-
ImpactReplace file contents, escalate to root
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires: (1) the Soft-RoCE/rxe software-RDMA kernel driver to be present and an rxe device available - not loaded by default on typical servers, which is the principal limiter; (2) kernel ODP (On-Demand Paging) support and the ability for the attacker to register an ODP memory region; (3) a target read-only mapping - a PROT_READ file mapping such as a page-cache folio behind /etc/passwd or a setuid binary held O_RDONLY. Affected kernels run from the commit 0b261d7c1cd3 baseline (~6.16) up to the stable fixes. Limiting factors: local access only (AV:L), the vulnerable rxe configuration is non-default, and the FLUSH-only/read-only ODP paths are unaffected since pmem flushes remain classified against the read-only check. |
| Impact | This is a genuine local privilege-escalation primitive, not merely a high-CVSS paper risk, but its real-world urgency is tightly bounded by configuration. The description establishes a Dirty-COW-class write primitive: a missing HMM_PFN_WRITE check in RDMA/rxe ODP write paths lets an unprivileged user overwrite read-only page-cache folios (e.g. /etc/passwd or setuid binaries) they hold only O_RDONLY to, yielding full system compromise. CVSS 3.1 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H, 7.8) is internally consistent with the narrative - local, low-privilege, no user interaction, full CIA impact via privilege escalation. However, signals pull toward LOW immediate priority: EPSS is 0.16% (5th percentile), there is NO CISA KEV listing and NO public exploit identified, so exploitation is neither confirmed nor probabilistically likely in the near term. The limiting factor is that exploitation requires the Soft-RoCE (rxe) software-RDMA driver to be present and an ODP memory region registration path available - a configuration absent from the vast majority of production Linux hosts. Note the Tags label this 'Information Disclosure,' which contradicts the description: the vulnerability is a memory-integrity/write primitive enabling privilege escalation, not disclosure - treat the category label as unreliable. Net: patch on normal kernel-update cadence; elevate only where rxe/Soft-RoCE is actually loaded. |
| Exploit ScenarioDerived | An unprivileged local user on a host with the rxe (Soft-RoCE) RDMA driver loaded maps a read-only file such as a setuid binary or /etc/passwd, registers an ODP memory region over that mapping, then directs incoming RDMA WRITE/READ-response/SEND/atomic traffic at it. Because the write-permission check was dropped, the kernel modifies the shared page-cache folio through kmap without breaking copy-on-write, corrupting the file on disk-backed cache and escalating to root. No public exploit code has been identified at time of analysis, though the technique is well understood as it mirrors Dirty COW and CVE-2022-2590. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Local privilege escalation and data-corruption primitive in the Linux kernel's RDMA/rxe (Soft-RoCE) software-RDMA driver: a missing HMM_PFN_WRITE permission test in the on-demand-paging (ODP) write path lets an unprivileged local user who can register an ODP memory region over a PROT_READ file mapping direct incoming RDMA traffic (RDMA WRITE, RDMA READ responses, SEND payloads, atomics) through kmap into read-only page-cache pages without ever triggering copy-on-write, overwriting files the attacker only holds O_RDONLY - classically /etc/passwd or a setuid binary - in the same primitive class as Dirty COW and CVE-2022-2590. The flaw was introduced by commit 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO pages"), which stripped the access-permission test from rxe_check_pagefault() and left only HMM_PFN_VALID, affecting kernels built from that baseline (reported as Linux 6.16 onward) until the stable fixes. Exploitation is bounded by configuration: the rxe/Soft-RoCE module is not loaded by default on typical servers, and the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) confirms a local, authenticated attacker with low complexity but no network reach; EPSS is low at 0.16% (5th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis. Vendor patches are available.
RemediationAI
Apply the vendor patch: upgrade to Linux 6.18.54, 7.2.8, or 7.3-rc4 (or the corresponding stable backport commit 769001ce838d907ecaa95f1d0a4e8fc86f761f9f, c6f56982ec5c7da83c4bdfcce3b6db18bcfe6425, or 2d6c6f94d3e1cde049fe5db71dbd5549f10b2de1) from the kernel.org stable tree, per the references at https://git.kernel.org/stable/c/769001ce838d907ecaa95f1d0a4e8fc86f761f9f, https://git.kernel.org/stable/c/c6f56982ec5c7da83c4bdfcce3b6db18bcfe6425 and https://git.kernel.org/stable/c/2d6c6f94d3e1cde049fe5db71dbd5549f10b2de1. Because the vulnerable configuration is non-default, the most effective immediate mitigation is to ensure the Soft-RoCE module is not loadable where it is not needed - blacklist or rmmod rdma_rxe and rxe, and block module autoloading via /etc/modprobe.d (install rdma_rxe /bin/false) - with the trade-off that any host genuinely using software RoCE loses its RDMA fabric, so confirm no rxe-dependent workloads exist first. On hosts that must keep rxe, restrict who can open the RDMA character devices (e.g. /dev/infiniband/* and the rdma_cm device) to trusted groups via udev rules or SELinux/AppArmor confinement, and audit for non-root users holding ODP-capable MR registrations; this narrows the local attack surface but does not remove the kernel bug and can break legitimate unprivileged RDMA applications. Note that disabling only ODP is not an offered workaround in the source data. There is no vendor-released patch identified for kernels older than the 6.16 baseline because the flaw did not exist there; the FLUSH/read-only ODP paths remain correctly classified after patching and require no additional change.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
rxe is the kernel's software RDMA (Soft-RoCE) driver that emulates an RDMA-capable HCA in software, and its On-Demand Paging (ODP) support relies on the HMM (Heterogeneous Memory Management) framework to fault user pages in on first touch. When an ODP memory region (MR) is registered, hmm_vma_fault() resolves pages and returns PFN flags describing what the caller may legally do with them; HMM_PFN_WRITE indicates the page was faulted for write and that a subsequent store is legitimate (breaking CoW into a private page if required). Commit 0b261d7c1cd3 removed the permission comparison from rxe_check_pagefault() so that only HMM_PFN_VALID was required, meaning a read-only fault against a page-cache folio behind a PROT_READ file mapping passed the check. rxe's write paths - RXE_PAGEFAULT_RDWR plus the write variants used by RDMA WRITE, RDMA READ responses, SEND payloads and atomic operations - then wrote through kmap() into shared page-cache storage rather than a private, CoW-broken copy. The reference implementation in mlx5 preserves the invariant by setting the device write bit only for pfns that carry HMM_PFN_WRITE; the fix restores the same requirement in rxe, demanding HMM_PFN_WRITE in rxe_check_pagefault() for every operation except RXE_PAGEFAULT_RDONLY. Practically, a write to a non-writable VMA now fails that single fault attempt with -EPERM from hmm_vma_fault() instead of re-faulting indefinitely, while a writable VMA faults normally, breaks CoW, and receives the write in a private page. The patch deliberately retains the read-only classification for FLUSH operations, because arch_wb_cache_pmem() never modifies memory and the FLUSH access bits do not make the umem writable - treating flushes as writes would break every flush against a flush-only MR. The root cause class is a missing access-control/permission check on a write path (the CVE carries no CWE assignment; the description's own framing places it alongside Dirty COW and CVE-2022-2590). CPE data identifies the affected product only generically as linux:linux, so version determination must come from the commit bounds rather than the CPE strings.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local unprivileged user (AV:L/PR:L) with a straightforward ODP-MR registration triggers the write primitive (AC:L); overwriting setuid/passwd yields full privilege escalation, so C/I/A all High.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths
Commit 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO pages") dropped the access permission test from rxe_check_pagefault() and left only HMM_PFN_VALID. A page faulted in read-only, for example a page-cache folio behind a PROT_READ file mapping, then satisfies the check and ODP write operations (RDMA WRITE, RDMA READ response, SEND payload, atomics) modify it through kmap without ever breaking CoW.
An unprivileged user can register an ODP MR over such a mapping and have incoming RDMA traffic overwrite the page cache of a file it only holds O_RDONLY, including /etc/passwd or setuid binaries. This is the same primitive class as Dirty COW and CVE-2022-2590.
mlx5 has the missing invariant: its ODP path sets the device write bit only for pfns that carry HMM_PFN_WRITE. Restore it in rxe by requiring HMM_PFN_WRITE in rxe_check_pagefault() for every operation except RXE_PAGEFAULT_RDONLY. A write to a non-writable VMA now fails the one fault attempt with -EPERM from hmm_vma_fault() instead of re-faulting forever. For a writable VMA the fault breaks CoW and the write lands in the private page.
Keep pmem flushes on the read-only check. arch_wb_cache_pmem() never modifies memory, and the FLUSH access bits do not make the umem writable, so classifying flushes as writes would make every flush against a flush-only MR fail.
Executive ViewAI
A high-severity flaw in the Linux kernel’s RDMA/rxe (Soft-RoCE) driver allows a local user to overwrite read-only system files, including /etc/passwd or setuid binaries, potentially escalating to root and corrupting critical data on affected hosts. The risk is limited to systems running affected kernels reported as Linux 6.16 onward with Soft-RoCE enabled and configured for local RDMA access, but those conditions can exist in multi-user HPC, container, and virtualized environments. A vendor patch is available, so prioritized remediation and, where feasible, disabling the rxe module should be treated as urgent.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB