EUVD-2026-93350
GHSA-3p8h-wx5x-6qq3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Linux host running rxe Soft-RoCE
-
DeliveryEstablish RDMA queue pair to target
-
ExploitCraft RETH with wrapping iova+length
-
ExecutionBypass mr_check_range bounds check
-
ImpactTrigger kernel OOB read/write and oops
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the target to be running the Linux RDMA Soft-RoCE (rxe) driver with a registered memory region reachable over an established RDMA queue pair; the attacker then sends an RDMA-Write or RDMA-Read whose RETH encodes an iova close to 2^64 (e.g. iova=0xfffffffffffffff8, length=8) so that iova+length wraps to 0 and passes the pre-fix range check. Key limiting factors that reduce realistic risk below the 9.8 score: the rxe module is not loaded in default Linux configurations, an RDMA fabric/connection to the victim must already exist, and the host must expose Soft-RoCE on a reachable interface. No OS-level authentication is required on the rxe path (PR:N), so within that configuration it is remotely triggerable by an unauthenticated peer. |
| Impact | Signals conflict sharply, which is the central story here. CVSS 3.1 base is 9.8 Critical (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), implying trivial unauthenticated remote total compromise, and the SSVC picture would be high technical impact (kernel OOB read/write and oops) with a plausibly automatable trigger (a single crafted RETH). However, EPSS is only 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit was identified - so SSVC exploitation status is effectively 'none' at analysis time. The reconciling factor the raw CVSS score hides is the attack surface: the vulnerable path lives in the RDMA/rxe (Soft-RoCE) responder, which is only reachable when the rxe driver is loaded and an RDMA queue pair to the victim already exists. That is why a 9.8 flaw carries a bottom-percentile EPSS - the CVSS vector does not encode the non-default subsystem requirement. Net: this is a genuine priority for the specific population running Soft-RoCE / software RDMA (where it is a pre-auth kernel memory-corruption bug), but for the overwhelming majority of Linux deployments that never load rxe it is low real-world risk. Treat as high-urgency patch only where RDMA rxe is in use. |
| Exploit ScenarioDerived | An attacker with network reachability to a Linux host running the rxe Soft-RoCE driver establishes an RDMA queue pair and issues an RDMA Write/Read whose RETH sets iova=0xfffffffffffffff8 and length=8, so iova+length wraps to 0 and bypasses the mr_check_range() bounds check. The responder then computes a huge page index and dereferences mr->page_info out of bounds, producing a kernel out-of-bounds read/write and oops. No public exploit code is identified at time of analysis; low attack complexity (AC:L) means a weaponized trigger would be straightforward once the rxe path is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Out-of-bounds read and write in the Linux kernel's RDMA Soft-RoCE (rxe) driver (CVE-2026-98365) lets an unauthenticated peer on an already-established RDMA queue pair send a crafted RDMA-Write or RDMA-Read RETH whose iova+length wraps to zero, bypassing the mr_check_range() bounds check and causing a kernel oops (and possible memory corruption) in rxe_mr_copy_xarray(). No public exploit code was identified at time of analysis and EPSS is low at 0.17% (5th percentile), but realistic exposure is gated by configuration: the rdma_rxe module must be loaded and the host must expose Soft-RoCE on a reachable interface, which is not the default Linux setup. Vendor-released patches are available in stable kernels 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
RemediationAI
Vendor-released patch: upgrade to Linux 6.6.158, 6.12.112, 6.18.54, 7.2.8 or 7.3-rc4 (or later) - the corresponding upstream fixes are commits b7d2118660545a00b21e83010ded1a231c6fb8c5, 5d9426a74fc8cb8f375fcdc19b465a030f9b8cab, 2f3b705144e3a3c14184fec6e354680081fe91ec, 3431f525718f6b07da308cda6d44f8cb548bbd37 and d10e2a08799e858d3e71ea4169bcd018f216d444; Linux distributions should be updated to the vendor kernel that carries this backport (see https://nvd.nist.gov/vuln/detail/CVE-2026-98365). If immediate patching is impossible, the strongest compensating control is to remove the attack surface entirely by unloading and blacklisting the rdma_rxe module (modprobe -r rdma_rxe; echo 'blacklist rdma_rxe' > /etc/modprobe.d/blacklist-rdma-rxe.conf), accepting the trade-off that Soft-RoCE functionality is lost and any workloads relying on it must migrate to hardware RoCE/iWARP interfaces. Where Soft-RoCE must remain, restrict reachability of the RoCEv2 UDP port (4791) to trusted RDMA peers using host firewalls or fabric segmentation and never expose rxe on untrusted or Internet-facing interfaces; this reduces but does not eliminate risk because a permitted peer can still craft the malformed RETH. Because the fix causes malformed requests to be answered with REMOTE_ACCESS_ERROR, repeated invalid-RETH events are a useful detection signal for monitoring on patched or unpatched hosts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is wraparound-prone integer arithmetic in mr_check_range(), which validates that the requested range [iova, iova+length) falls inside the registered memory region. The pre-fix test iova + length > mr->ibmr.iova + mr->ibmr.length can be defeated when iova is near 2^64 - for example iova=0xfffffffffffffff8 with length=8 makes iova+length wrap to 0, so the comparison passes. rxe_mr_iova_to_index() then computes a huge index that is only guarded by WARN_ON, and rxe_mr_copy_xarray() dereferences mr->page_info[idx] past the end of the xarray, producing an out-of-bounds read/write. The upstream fix rewrites the check as iova < mr->ibmr.iova || length > mr->ibmr.length || iova - mr->ibmr.iova > mr->ibmr.length - length, where the first two clauses guarantee the subtractions cannot underflow; crafted requests now return -EINVAL and the responder reports REMOTE_ACCESS_ERROR. The affected component is the in-kernel Soft-RoCE (rxe) software RDMA driver, a pure-software RoCEv2 implementation, matching CPE cpe:2.3:a:linux:linux. The CNA supplied no CWE, but the class is a wraparound/overflow arithmetic defect that enables an out-of-bounds access (CWE-190 with CWE-125/CWE-787 impact), and tags classify it as a Linux buffer overflow.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth remote peer crafts one RETH (AV:N, AC:L, PR:N, UI:N); kernel OOB read/write gives full C:H/I:H and oops gives A:H, with no scope change (S:U).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic:
if (iova < mr->ibmr.iova || iova + length > mr->ibmr.iova + mr->ibmr.length)
A remote peer can craft an RDMA-Write/Read RETH so that iova + length wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the check. rxe_mr_iova_to_index() then computes a huge index (int idx, only guarded by WARN_ON) and rxe_mr_copy_xarray() dereferences mr->page_info[huge], causing an out-of-bounds read/write and a kernel oops that is triggerable by an unauthenticated remote peer.
Rewrite the check in overflow-safe form; the first two clauses guarantee that the subsequent subtractions do not underflow:
if (iova < mr->ibmr.iova || length > mr->ibmr.length || iova - mr->ibmr.iova > mr->ibmr.length - length)
With the fix, mr_check_range() returns -EINVAL for the crafted iova and the responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB.
Executive ViewAI
Organizations running Linux kernels with the RDMA Soft-RoCE (rxe) driver loaded and reachable may face kernel crashes or memory corruption from CVE-2026-98365, a critical-severity flaw in a non-default networking component. Affected systems include RDMA-enabled clusters, storage, HPC, and cloud hosts that expose Soft-RoCE, where a peer on an established queue pair could trigger the issue. Vendor patches are available and no public exploit identified at time of analysis, so leadership should prioritize patch validation and reduce exposure on any Soft-RoCE interfaces.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB