CVE-2026-98366— RDMA/rxe: validate access flags before swapping the MR's PD
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： RDMA/rxe: 在交换内存注册器（MR）的保护域（PD）之前，先验证访问标志 函数首先重新分配 ，之后才验证 参数： 由于 定义为 ，两个标志位均能通过入口检查。因此，调用方可以在 已被重新分配的情况下，才到达访问权限检查逻辑。 由内核核心部分管理，仅在执行成功路径时调整 。当驱动程序发生错误时， 会跳转到 ，但未撤销之前的重新分配操作，导致出现 而引用计数仍归属于 的不一致状态。随后， 会递减 的引用计数，其值可能变为零，此时内存窗口（MW）仍引用该 PD。仅基于
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c< 08f12745cb72981aa2cabe214af0c7a42a856f0a |
affected |
544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c< 7230cc456d4bb2221c20c5f1d22b38b8576aa16f |
affected | ||
544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c< fe602c91a52e161ace4afd5bdb8f33270c554c6f |
affected | ||
544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c< 4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8 |
affected | ||
544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c< ae36a5b609ae79f4de966328b78d2584be9719a4 |
affected | ||
6.5 |
affected | ||
< 6.5 |
unaffected | ||
6.6.158≤ 6.6.* |
unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-98366
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RDMA/rxe: validate access flags before swapping the MR's PD
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: validate access flags before swapping the MR's PD
rxe_rereg_user_mr() reassigns mr->ibmr.pd first and only then
validates the IB_MR_REREG_ACCESS argument:
if (flags & IB_MR_REREG_PD) {
rxe_put(old_pd);
rxe_get(pd);
mr->ibmr.pd = ibpd;
}
if (flags & IB_MR_REREG_ACCESS) {
if (access & ~RXE_ACCESS_SUPPORTED_MR)
return ERR_PTR(-EOPNOTSUPP);
mr->access = access;
}
Both flags pass the entry check because RXE_MR_REREG_SUPPORTED is
IB_MR_REREG_PD | IB_MR_REREG_ACCESS, so a caller can reach the access
check with mr->ibmr.pd already reassigned.
mr->ibmr.pd is owned by the core, which adjusts pd->usecnt only on the
success path: ib_uverbs_rereg_mr() jumps to put_new_uobj on a driver error
without undoing the reassignment, so mr->pd == new_pd while the usecnts
still charge the MR to orig_pd. ib_dereg_mr_user() then decrements
new_pd, whose count can reach zero while a memory window still references
it; uverbs_free_pd() frees the PD on that count alone and rxe_mw_cleanup()
writes to freed memory:
BUG: KASAN: slab-use-after-free in __rxe_put+0x31/0xa0
Write of size 4 at addr ffff8881301dd690 by task rxe_poc/591
__rxe_put+0x31/0xa0
rxe_mw_cleanup+0x42/0x200
__rxe_cleanup+0x115/0x370
rxe_dealloc_mw+0x4c/0x80
Allocated by task 591:
ib_uverbs_alloc_pd+0x258/0x540
Freed by task 591:
ib_dealloc_pd_user+0x174/0x210
uverbs_free_pd+0x8d/0xc0
ib_uverbs_dealloc_pd+0x18e/0x1d0
Validate the access flags before mutating any state so the callback either
applies every requested change or none.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-98366
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-98366
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-98366 (5)
Same Patch Batch · Linux · 2026-10-06 · 208 CVEs total
| CVE-2026-98323 | 9.8 CRITICAL | RDMA/siw: Bound fragmented header copies by the remaining length |
| CVE-2026-98365 | 9.8 CRITICAL | RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access |
| CVE-2026-98282 | 8.8 HIGH | powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba |
| CVE-2026-98339 | 8.8 HIGH | wifi: cfg80211: don't filter by BSS type when removing stale entries |
| CVE-2026-98171 | 8.8 HIGH | smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs |
| CVE-2026-98283 | 8.8 HIGH | KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() |
| CVE-2026-98261 | 8.1 HIGH | cifs: Fix server use-after-free in cifs_chan_skip_or_disable() |
| CVE-2026-98357 | 8.1 HIGH | IB/isert: wait for deferred control PDU completions before releasing the connection |
| CVE-2026-98239 | 8.1 HIGH | net: lan743x: fix RX checksum use-after-free |
| CVE-2026-98341 | 7.8 HIGH | wifi: cfg80211: don't free driver-owned scan requests |
| CVE-2026-98260 | 7.8 HIGH | exec: Cleanup POSIX timers right after de_thread() |
| CVE-2026-98281 | 7.8 HIGH | futex: Also allocate private hash on vfork() |
| CVE-2026-98324 | 7.8 HIGH | dmaengine: pxa: fix double counting of the hw descriptors |
| CVE-2026-98320 | 7.8 HIGH | netfilter: flowtable: hold reference on ct until flow is released |
| CVE-2026-98228 | 7.8 HIGH | mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| CVE-2026-98229 | 7.8 HIGH | xfrm: save input state data before secpath resets |
| CVE-2026-98318 | 7.8 HIGH | smb: client: validate absolute native symlink targets before NT fixups |
| CVE-2026-98256 | 7.8 HIGH | signal: Prevent exec() race |
| CVE-2026-98253 | 7.8 HIGH | RDMA/ucma: Serialize join and leave on copy_to_user failure |
| CVE-2026-98254 | 7.8 HIGH | swiotlb: use the adjusted address for the highmem page lookup |
Showing top 20 of 208 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98374
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_s -
CVE-2026-98373
mm/hugetlb: preserve mremap address delta when skipping page -
CVE-2026-98372
xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk -
CVE-2026-98371
xfrm: iptfs: fix runt reassembly panic from short inner tot_ -
CVE-2026-98370
xfrm: fix compat ALLOCSPI request use-after-free
Same vendor: Linux
-
CVE-2026-98374
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_s -
CVE-2026-98373
mm/hugetlb: preserve mremap address delta when skipping page -
CVE-2026-98372
xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk -
CVE-2026-98371
xfrm: iptfs: fix runt reassembly panic from short inner tot_ -
CVE-2026-98370
xfrm: fix compat ALLOCSPI request use-after-free
V. Comments for CVE-2026-98366
No comments yet