PatchSiren cyber security CVE debrief

CVE-2026-46043 Linux CVE debrief

CVE-2026-46043 is an integer underflow vulnerability in the Linux kernel's RDMA/rxe (Soft-RoCE) driver. The flaw exists in the `rxe_rcv()` function, which validates incoming packet length against only `header_size(pkt)` before calling `payload_size()`. However, `payload_size()` subtracts both the attacker-controlled BTH pad field and `RXE_ICRC_SIZE` from `pkt->paylen`. A malicious packet with a forged non-zero BTH pad value can cause `payload_size()` to underflow, passing a negative (wrapped) value to downstream receive-path code. The fix validates `pkt->paylen` against the complete minimum length: `header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE`. This vulnerability affects systems with the rxe driver enabled and could lead to memory corruption or denial of service through crafted RDMA packets.

Vendor: Linux
Product: Unknown
CVSS: CRITICAL 9.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-27
Original CVE updated: 2026-06-16
Advisory published: 2026-05-27
Advisory updated: 2026-06-16

Who should care

Organizations running Linux systems with RDMA over converged Ethernet (Soft-RoCE) enabled, particularly HPC clusters, cloud infrastructure, and storage networks utilizing RDMA protocols

Technical summary

The rxe driver in the Linux kernel fails to properly validate packet length against all components subtracted in `payload_size()`. The function calculates payload size as `pkt->paylen - offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE`. Prior validation only ensured `pkt->paylen >= header_size(pkt)`, permitting packets where `bth_pad(pkt) + RXE_ICRC_SIZE` exceeds remaining bytes to cause integer underflow. The vulnerability is remotely exploitable by sending crafted RDMA packets with manipulated BTH pad fields to systems with rxe enabled.

Defensive priority

high

Recommended defensive actions

Apply kernel updates containing the referenced stable commits when available from your Linux distribution
Disable the rxe (Soft-RoCE) driver if RDMA over converged Ethernet is not required
Monitor network traffic for anomalous RDMA packets with unusual BTH pad values
Review system logs for kernel warnings or crashes related to rxe_rcv
Verify kernel version against patched releases once distribution advisories are published

Evidence notes

Vulnerability description confirms integer underflow in payload_size() calculation. Kernel commit references indicate fixes applied to multiple stable branches. No CVSS score or severity assigned by NVD at time of disclosure.

Sources and references

Verified primary and authoritative sources

CVE-2026-46043 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46043

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46043 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46043

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/2fd4f8b749309a61c3f3f88ee8891d94f79e1240

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/7244491dab347f648e661da96dc0febadd9daec3

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/9b924f3a26b21330a837cfe72e819b6393bbeeaa

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/e8ee0e792d475b1067c199ef0af1b6221fa6f43d

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/f83519a4c122c9c7a850a2197648a9ff4c67c520

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.