PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46114 Linux CVE debrief

A remote information disclosure vulnerability exists in the Linux kernel's RDMA/rxe (Soft-RoCE) driver. The `atomic_write_reply()` function in `drivers/infiniband/sw/rxe/rxe_resp.c` unconditionally dereferences 8 bytes from the packet payload without validating that the payload contains exactly 8 bytes as required by the InfiniBand Architecture specification (IBA oA19-28). The `check_rkey()` function previously accepted ATOMIC_WRITE requests with `pktlen == resid == 0`, allowing a remote initiator to send a zero-length ATOMIC_WRITE request. This causes the responder to read 8 bytes from beyond the logical end of the packet—specifically from skb head-buffer tailroom—and write those bytes into the attacker's Memory Region via `rxe_mr_do_atomic_write()`. This results in remote disclosure of kernel memory contents, including recognizable kernel strings and partial kernel-direct-map pointer words. The vulnerability was reproduced on mainline kernels with sustained zero-length ATOMIC_WRITE probes. The fix enforces strict 8-byte payload validation in `check_rkey()` before reaching the vulnerable dereference, while preserving existing WRITE-family length logic for normal RDMA WRITE operations.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-24
Advisory published
2026-05-28
Advisory updated
2026-06-24

Who should care

Organizations running Linux kernels with Soft-RoCE (rxe) enabled, particularly those exposing RDMA services to untrusted networks or multi-tenant environments. Cloud providers, HPC facilities, and storage systems using RDMA over converged Ethernet (RoCE) software implementations.

Technical summary

The RDMA/rxe (Soft-RoCE) driver implements the InfiniBand ATOMIC_WRITE operation without proper payload length validation. The `check_rkey()` function only compared `pktlen` against `resid`, accepting requests where both were zero. This allowed remote attackers to trigger an 8-byte out-of-bounds read from skb tailroom in `atomic_write_reply()`, leaking kernel memory into attacker-controlled Memory Regions. The fix adds explicit 8-byte payload validation to `check_rkey()` before the ATOMIC_WRITE path reaches `atomic_write_reply()`.

Defensive priority

high

Recommended defensive actions

  • Apply the relevant stable kernel patch for your kernel version: 5.10.y (ref-4), 5.15.y (ref-5), 6.1.y (ref-6), 6.6.y (ref-7), or 6.12.y (ref-8)
  • If Soft-RoCE (rxe) is not required, consider disabling or blacklisting the rxe kernel module as a temporary mitigation
  • Monitor for suspicious RDMA traffic patterns involving ATOMIC_WRITE operations with anomalous length fields
  • Review RDMA fabric access controls to restrict initiator connections to trusted endpoints
  • Audit kernel logs for rxe responder errors that may indicate probing activity

Evidence notes

The vulnerability description provides detailed technical analysis including the vulnerable code path (`atomic_write_reply()` → `*(u64 *)payload_addr(pkt)`), the insufficient validation in `check_rkey()`, and reproduction results confirming kernel memory disclosure. Five stable kernel patches are referenced. The IBA oA19-28 specification is cited as the protocol authority defining ATOMIC_WRITE as exactly 8 bytes.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46114 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46114

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46114 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46114

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/105bf79a23b85cf3a761d18a4f3e10ce88526bc1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1114c87aa6f195cf07da55a27b2122ae26557b26

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/539cabb7b2d8ba70f55bba91db55faef11c2a6d7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7ec1ed4747f5f99f8b797bb438c5efd36079fad5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d415fce3fcde6d7aeea6c25362a395b905811452

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.